psilva's prophecies: April 2014

Thursday, April 24, 2014

A Decade of Breaches

Whales Not Included

Being from the Hawaiian Islands, the annual gathering of the Kohola (humpback whales) is always a spectacular view. They can get over half their body out of the water and administer a cannonball body slam splash like you've never seen before. Most of the internet thinks they breach to either see what's up (so to speak), let other whales know they are around (if the haunting squeal isn't doing it) and most common, to relieve the body of lice, parasites and barnacles.

While nature's breaches are unmatched, many internet security breaches are run of the mill leakages.

The Verizon 2014 Data Breach Investigation Report (DBIR) found that over the last 10 years, 92% of the 100,000 security incidents analyzed can be traced to nine basic attack patterns. The patterns identified are:

Miscellaneous errors like sending an email to the wrong person
Crimeware (malware aimed at gaining control of systems)
Insider/privilege misuse
Physical theft or loss
Web app attacks
Denial of service attacks
Cyberespionage
Point-of-sale intrusions
Payment card skimmers

The really cool thing about the 9 attack patterns is that Verizon has also charted the frequency of incident classification patterns per industry vertical. For instance, in financial services 75% of the incidents come from web application attacks, DDoS and card skimming while retail, restaurants and hotels need to worry about point-of-sale intrusions. Utilities and manufacturing on the other hand get hit with cyber-espionage. Overall across all industries, only three threat patterns cover 72 percent of the security incidents in any industry.

Once again, no one is immune from a breach and while media coverage often focuses on the big whales, the bad guys are not targeting organizations because of who they are but because a vulnerability was found and the crooks decided to see if they could get more. This means that companies are not doing some of the basics to stay protected. For the 2014 analysis, there were 1,367 confirmed data breaches and 63,437 security incidents from 50 global companies.

For the most part, the fixes are fairly basic: Use strong authentication, patch vulnerabilities quickly and encrypt devices that contain sensitive information. I've barely scratched the surface of the report and highly suggest a through reading.

Photo: Protected Resources Division, Southwest Fisheries Science Center, La Jolla, California.

Technorati Tags: f5,dbir,breach,attack,cyber,verizon,ddos,security,silva

Connect with Peter:	Connect with F5:

Tuesday, April 15, 2014

The Weekend of Discontent

This past weekend, like many of you, I started getting the blood curdling password resets from a bunch of OpenSSL affected sites. I also got a few emails from sites indicating that I had nothing to worry about. Bad news, good news. Probably the biggest security story thus far for 2014 is Heartbleed, the OpenSSL vulnerability which potentially allows attackers to extract 64 kilobyte batches of memory at random without being noticed and leaving no trace. Sounds like the perfect crime.

It also got me thinking.

First, I wondered if this was a new era of security by force. The vulnerability and the totality of the hole forced many of us to change passwords on many sites. What a pain. It was a huge reminder that no matter how many 'experts' urge regular password rotation, it is a real time consuming, frustrating task. It's no wonder that so many keep the same password for years or use the same password across multiple sites. With so many sites requiring some authentication or verification for either resources or customization, people can have hundreds username/password combinations. Sure there are password keepers but part of me is reluctant to put all my web identities with one entity. What if that gets hit? There are just some sites that I chose not to save and auto-fill but enter it every time. Then, of course, I'm susceptible to key loggers. Great.

Then there are the developers. I imagine that this past weekend was the most worked ever by the entire coding community. Administrators across many sectors were working to patch vulnerable systems all over the globe to reduce the security threat. A massive undertaking to help fix over two-thirds of the internet. The weekend work of many fingers plugging dikes was probably only surpassed by the marketers and PR folks maneuvering their stories around what it is, what's at risk, what you should do and other FAQs surrounding this security superstar. @LanceUlanoff speculated on twitter, 'Is Heartbleed the first Internet bug with its own Web site? http://t.co/M9u976X9ui'

With so many sites and so many people affected along with the massive media coverage, will things change? Or will this be like Y2K with a bunch of dire warnings only to have nothing major occur? Is this a wake up call or will it dissolve into yesterday's news as new 'breaking' stories grab our attention? I think (and hope) that this is so critical that many organizations will be taking a more detailed look at their security infrastructure even if they are not vulnerable to Heartbleed. It forces many, if not all internet users, including the administrators themselves, to take a look at how we are protecting ourselves. It'll be interesting to see if '12345678' or 'qwertyui' or even 'password' continues to be the most popular pass codes after this massive reset.

If you need assistance with your Heartbleed crisis, click here to learn how F5 can help.

Technorati Tags: f5,security,heartbleed,openssl,vulnerability,web,silva,passwords

Connect with Peter:	Connect with F5:

Wednesday, April 9, 2014

The DNS of Things

Hey DNS - Find Me that Thing!

There's a new craze occurring in homes, highways, workplaces and everywhere imaginable - the Internet of Things or as I like to call it, The Internet of Nouns. Sensors, thermostats, kitchen appliances, toilets and almost every person, place or thing will have a chip capable of connecting to the internet. And if you want to identify and find those things with recognizable words instead of a 128-bit IP address, you're going to need DNS.

DNS translates the names we type into browser or mobile app into an IP address so the services can be found on the internet. It is one of the most important components of the internet, especially for human interaction. With the explosion of mobile devices and the millions of apps deployed to support those devices, DNS growth has doubled in recent years. It is also a vulnerable target.

While the ability to adjust the temperature of your house or remotely flush your toilet from around the globe is cool, I think one of the biggest challenges of the Internet of Nouns will be the strain on DNS. Not only having to resolve the millions of additional 'things' getting connected but also the potential vulnerabilities and risks introduced when your washing machine connects to the internet to find the optimal temperature and detergent mix to remove those grass, wine and blood stains.

Recent research suggests that the bad guys are already taking advantage of these easy targets. Arstechnica reports that the malware that has been targeting routers has now spread to DVRs. Not my precious digital video reorder!! Last week, Sans found a Bitcoin mining trojan that can infect security camera DVRs. As they were watching a script that hunted the internet for data storage devices, they learned that the bot was coming from a DVR. Most likely, they say, it was compromised through the telnet defaults.

In another report, ESET said it found 11 year old malware that had been updated with the ability to compromise a residential broadband router's DNS settings. The malware finds a vulnerable router and changes the default DNS entries to either send the person to a rogue site to install more malware (join the bot, why don't ya) or to just redirect them to annoying sites. Imagine if the 50+ connected things we will soon have in our homes also joined the bot? Forget about needing compute and bandwidth from machines around the globe, you can zero in on a neighborhood to launch an attack.

Nominum research shows that DNS-based DDoS amplification attacks have significantly increased in the recent months, targeting vulnerable home routers all over. A simple attack can create tens-of-gigs of traffic to disrupt networks, businesses, websites, and regular folks anywhere in the world. More than 24 million home routers on the Internet have open DNS proxies which expose ISPs to DNS-based DDoS attacks and in February 2014 alone, more than 5.3 million of these routers were used to generate attack traffic. These are especially hard to track since it is difficult to determine both the origination and target of the attack.

Lastly, Ultra Electronics AEP says 47% of the internet remains insecure since many top level domains (TLDs) have failed to sign up to use domain name system security extensions (DNSSEC). These include heavy internet using countries like Italy (.it), Spain (.es) and South Africa (.za), leaving millions of internetizens open to malicious redirects to fake websites. Unless the top level domain is signed, every single website operating under a national domain can have its DNS spoofed and that's bad for the good guys.

We often don't think about the Wizard behind the curtain until we are unable resolve an internet resource. DNS will become even more critical as additional nouns are connected and we want to find them by name. F5 DNS Solutions can help you manage this rapid growth with complete solutions that increase the speed, availability, scalability, and security of your DNS infrastructure.

And I do imagine a time when our current commands could also work on, for instance, the connected toilet: /flushdns.

Just couldn't let that one go.

Technorati Tags: f5,dns,dnssec,ddos,security,iot,things,big-ip,malware,silva,trojan

Connect with Peter:	Connect with F5:

Friday, April 4, 2014

Interop 2014: The Blooper Reel

All the outtakes, mistakes and behind the scenes during our Interop 2014 video shoot. Always fun. Enjoy!

Technorati Tags: f5,interop,video,bloopers,outtakes,fun,humor,silva

Connect with Peter:	Connect with F5:

Thursday, April 3, 2014

Interop 2014: That’s a Wrap

I wrap it up from Interop 2014. Special thanks to Ken Bocchino and Joe Wojcik for some Interop NOC goodness, thanks to Tim Wagner for some Synthesis love and thanks to Natasha, Greg, Paul and Jay for their camera work. And of course, thanks to you for watching. Reporting from Mandalay Bay Convention Center in Vegas.

Technorati Tags: f5,Interop,vegas,synthesis,security,silva,video,noc,dns,spdy,ipv6,big-ip

Connect with Peter:	Connect with F5:

Interop 2014: F5 Interop NOC Stats

We visit with Ken Bocchino and Joe Wojcik of F5 Professional Services again to get some insight on the Interop.net network stats for the week. We talk DNS (15 million DNS lookups, half via BIG-IP recursion), SPDY and IPv6 along with a little insight on some of the overall traffic and the attack mitigation that occurred for the World’s Largest Temporary Network.

ps
Related

Technorati Tags: f5,Interop,vegas,synthesis,security,silva,video,noc,dns,spdy,ipv6,big-ip

Connect with Peter:	Connect with F5:

Wednesday, April 2, 2014

Interop 2014: F5 Synthesis Whiteboard (feat Wagner)

Synthesis in the Wild! Tim Wagner, Manager, Field Systems Engineering, shows how he whiteboards the F5 Synthesis story to help organizations understand the value of SDAS – Software Defined Application Services. He discusses SDN and how that works within a Layer 2/3 environment and the power of SDAS for Layers 4-7 with its ability to apply important services to the applications that need it…all on a single platform. Interesting discussion on how marketing visions translate into real customer solutions available today.

Technorati Tags: f5,Interop,vegas,synthesis,security,silva,video,sdas,sdn,consolidation,whiteboard

Connect with Peter:	Connect with F5:

psilva's prophecies