Security (b)log - English edition

2023-11-17

Kafka's Castle

Image from Pixabay

Remember that castle I wrote about last week? Where they didn't trust anyone, because they assumed the enemy was already within the walls of the castle? I went for a walk around the area, and guess what? There is another castle just down the road. And they do things in a completely different way there.

Not so long ago I heard this statement at a conference: we must move from 'low trust, high tolerance' to 'high trust, low tolerance'. That’s one of those statements to which the audience mumbles in agreement, without yet understanding exactly what it means. I make a note of those kinds of statements to think about them later. Writing a blog is an excellent way to hatch an egg like that one. Buckle up, dear reader, because at this point I don't know yet where the story is going.

The statement contains the assumption that many organizations work from a kind of non-trust (which is different from distrust), much like in last week's castle. There are many rules that you have to adhere to, because you probably won't do the right thing on your own. Not because you don't want to, but because you can't know them all. And because there are so many rules, it is very difficult to adhere to them all. If only because you do not know all the rules, but also because some rules are not feasible, or because it is sometimes inconvenient. You know, that word 'actually'. Whenever someone says that something shouldn’t actually be done in that way, you already know that a rule will be worked around. The lord of the castle knows this too, and therefore turns a blind eye to many things: he is very tolerant, as long as the rules are not broken deliberately and with malicious intent.

The statement from the second paragraph implies that that attitude is not good, because well, we 'must' move towards that other model: high trust, low tolerance. This lord of the castle assumes that everyone who works for him understands very well what is and is not possible, because many things are obvious. When you enter somewhere, you close the door behind you. Not only because otherwise it would be draughty, but also because someone might slip in who shouldn't be there. If you’re in charge of the lady's jewelry, you probably understand that you are not supposed to lend them to your girlfriend for an evening. So there are far fewer formal rules, but woe betide you if you betray trust and they find out. Then you'll be in the dungeon on bread and water in no time. There is little tolerance.

Do you know Franz Kafka's novel Der Prozess (The Trial)? That story revolves around Josef K., who is arrested and ultimately convicted without ever knowing why. Apparently he sinned against rules that he did not know – even could not have known. We could easily end up in such a Kafkaesque situation if we work on the basis of 'high trust, low tolerance'. Not a nice place to live, that castle.

What about a middle ground? I call it 'some trust, some tolerance'. It is probably true that we have too many rules, which no one knows anyway. Every citizen is supposed to know the law, they say. But how realistic is that, if taken literally? Even without knowledge of the law, you know that you are not allowed to puncture car tires, right? Likewise, there are numerous security rules that people adhere to anyway. Or where a little more tolerance wouldn't hurt. It annoys me every time when the app, in which I can see my daughter's class schedule, kicks me out if I haven't checked the app for a few weeks. Then I have to log in again, and then I always have to figure out how that works, because it works differently than elsewhere. How exciting is what's in that app? Let it piggyback on the security of my phone. Even my bank's app is easier (after an initial strict admission procedure).

So we can probably get by with fewer rules, but we also have to learn to be less tolerant. Still too often someone does something in a way that they know perfectly well is not the way it should be, but – of course with the best intentions, no doubt – they still manage to do it in that way. It works, but there are too many risks involved that may have been overlooked. Tolerance should not be taken, it should be given. From the person who is responsible.

So we need a new castle, at an appropriate distance from Kafka's. With residents who reasonably adhere to rules that mainly regulate what is not obvious to everyone. That model will only work for people, by the way. Let’s stick to zero trust for systems.

Next week there will be no Security (b)log.

And in the big bad world...

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

2023-11-10

The leaking castle

Image from Pixabay

Assume breach – you can safely assume that your systems have been compromised; hackers have already managed to gain access to your IT resources without you noticing. Of course this isn’t a very joyful assumption. It means something like: my security will fail and I can't stop it. It sounds like you're putting your head down, like a capitulation. However, it is not intended that way. No, the assume breach mindset is pointing out that your opponents have so many opportunities to penetrate your castle that it is simply impossible to always adequately protect all holes.

Let me deepen the castle metaphor a little further using the age-old parable as we know it in information security, with the castle moat, the drawbridge and the crown jewels in the robust keep. That comparison emphasizes how well we are doing with our layered security. What I want to talk about is that those layers all have their weaknesses.

Let's start with the moat. That’s easy: in winter you can sometimes just walk over it (yes, you young people, it used to get so cold in winter that all bodies of water in the country would freeze). I think many proud medieval castle lords were surprised when it turned out that their ingenious water barrier could easily be overcome without boats, as long as the enemy waited for the right moment. We have the drawbridge for normal crossing of that water. What happens if the chains or ropes used to raise the bridge snap? Then the bridge deck falls down and everyone can cross it. From a security perspective, if something is broken you don't want the unsafe situation to become the default.

But fortunately we still have the portcullis, which closes the opening in the castle wall. If its chains snap, it will fall and access will be blocked. That is, if it doesn't go askew due to the uncontrolled fall and become stuck. Then it remains open again and the enemy can still enter.

Finally, there is the donjon, or keep, the sturdy residential tower of the lord of the castle. It has thick walls and narrow windows. Valuables and important people would stay on the top floor, I imagine, furthest away from an intruder. I'm just afraid they wouldn't have anywhere to go if the enemy started a fire.

The onion model is based on the hope that if one layer is broken, the next layers will still stop the attacker. But is it really so inconceivable that all layers are leaking at the same time? The moat is frozen, the portcullis is rusted and the enemy, who marches in unhindered, smokes out the lord of the castle. But you forgot the archers! Well, that is a matter of attacking with a sufficiently strong and well-equipped army.

So assume that the attacker is already inside, the assume breach mindset tells us. Maybe he isn't at the top of the keep yet, but he is already walking around within the walls of your castle. He is in disguise and waiting for a good moment to make his move. What do you do when you think you know that the enemy in disguise is already inside? Then you don't trust anyone anymore. In security terms: zero trust. You assume that no one can be trusted and that every time someone wants something, you have to check whether that is allowed. Not: “Hi Pete, come in,” but: “Hi Pete, let's check whether you are still allowed in.” This in turn presupposes that it is perfectly clear what is allowed and what isn’t. Can it be true that so many employees have access to that important system? Or can you maybe reduce that attack surface through a better authorization structure? The more people can do something, the more people an attacker can try to deceive through, for example, phishing. Another important measure in this context is two-factor authentication: you say that this is your user ID and password, but that alone is not good enough to gain access.

In the physical castle, zero trust only works up to a point. Ultimately, the lord of the castle will have to be able to trust his bodyguards and his cook. He can take extra measures: remove the jewelry from the display cabinet and store it in a locked chest, for example. Thus making it a bit more difficult for an attacker. And that is what our profession is all about.

And in the big bad world...

2023-11-03

Betrayed by your phone

Image from Pixabay

Last Tuesday I was in the auditorium of a hotel in Venlo. Standing on the presenter’s side in a lecture hall is a bit intimidating, but after four presentations to groups of colleagues about the risks of their online existence, it fit me like a glove.

An important part of those risks has to do with your privacy. While you can use all kinds of apps for free, most apps also do something on their own: they collect data about you. And they sell that information to advertising companies, who use this information to create profiles. Your name is not necessarily linked to this: mobile devices work with an advertising ID that is linked to your device. Is your privacy well protected by this feature? Meh.

As is often the case in information security, it is all about who you are, or sometimes also what you are. Take phishing for example. This can be done in two ways: the criminals use a dragnet and are fine with whatever they catch, or they use a spear to catch exactly the one fish they want. For example, because they know that that person has access to the company's money and is therefore a good target to receive an email 'from the CEO', stating that he must immediately transfer a nice amount of money to a certain bank account. This form of phishing is called spear phishing; you now understand why.

Back to the advertising world. As we saw, profiles are created for advertising purposes, but who says those profiles can only be used for that purpose? Suppose you have a collection of profiles. You could then create a map showing all the devices in a certain area. You don't know who they belong to, you just see the advertising IDs. Then you could single out one of those IDs and turn the question around, so to speak: where has this device been? That may provide a clue of places where the device is often found. And that in turn offers the opportunity to find out where someone works and where he lives.

For most of us, that's not a threat – we're not interesting enough for that. But what if you’re a criminal and therefore the police are looking for you? By using information, which is actually intended for placing advertisements, they may be able to get close to you. Unfortunately, it also works the other way: what if you’re in law enforcement and you have to deal with criminals that also have access to that kind of information? Of course either side also needs specialized software for this. Reputable companies that could make something like this would probably only supply such a product to law enforcement. Unfortunately, organized crime is also becoming smarter and moreover, they have plenty of money to have something like that built. That could be a serious threat. In the context of personnel care, the Dutch financial crimes unit kindly requested this blog post on the matter. But of course it can also be relevant for other colleagues and for people outside our organization.

You can do something about this quite easily. The advertising ID of your device can be turned off. This makes you invisible on the map, and your device will not appear if someone asks the question: which devices are present around this office building around eight in the morning and five in the afternoon? Advertising companies such as Google and Meta will inform you that you will then see 'less relevant' advertising. So what! I brush aside the advertising for strollers as easily as I would the advertising for running shoes. And remember, if you also have your private phone in your pocket while at work, you want to kill the advertising ID on that device as well. Here is a brief description of how to do this in iOS/IpadOS and in Android. And in this video, John Oliver explains again how trading your data works. The entire video is interesting; fast forward to 10:10 if you just want to see the part about phone location.

The above tips are of course only intended for people on the right side of the law. It is advisable for criminals not to follow the tips, because that could have all kinds of unpleasant consequences.

And in the big bad world...

2023-10-27

Tech support scam

Image from Pixabay

Cry for help from the audience: “Help, I've been fooled!” In such a case I listen to both ears: the left one listens to hear how I can help, the right one listens to see if there’s a story that could be useful to others. Both ears got their money's worth. In this case, the person in question (let's call him Bert) already asked if I wanted to write a blog about it, otherwise I would have asked if he was okay with that.

Let me paint the picture. Bert had an old, slow PC at home on which he wanted to install the new version of his virus scanner. That didn't work out. That's why he wanted to go to the supplier's site and find a solution. He googled the name of his virus scanner, clicked on the top result and ended up at the requested site. Shortly afterwards a chat popped up: we have noticed a problem on your computer and we would like to help you.

Yes please, Bert replied; After all, he was on that site because he indeed had a problem. In order to be helped, he had to install a program (GoToAssist) to let the friendly helper look at Bert's computer. That's what Bert did. A viewing program (remote support) like that often lets the helper take over the computer, allowing him to get things done; You probably know that from your work. A moment later, the directory tree of Bert's computer scrolled across the screen, and suddenly everything turned red. Oh dear! A few thousand Trojan horses had been found!

A Trojan horse is a specific type of computer virus. Bert rightly asked why they had not been intercepted by his virus scanner. That's because the company's standard scanner doesn't detect Trojan horses at all, the helpdesk employee replied. But luckily she was able to offer Bert an extra program that would fill in the gap. They had subscriptions available for 1, 2 and 5 years, for just a few hundred euros.

At this point – about half an hour into the chat – Bert smelled a rat. He asked the helpdesk how he could be sure he was really chatting with someone from the antivirus company. There was no clear answer, after which Bert terminated the connection and, on the advice of his sister, who he was now on the phone with, pulled the network cable from the PC.

What had happened here? To begin with, Bert had not ended up on the real site of his supplier at all. Criminals recreate websites and ensure that they end up at the top of the search results. Almost no one looks closely at the address (URL) in a search result, so if it says you're going to virusscanner.com, it's easy to miss that you're actually going to viruscanner.com. When Bert ended up on the fake site, the criminal started a chat and tricked Bert into installing that remote support program. Once inside, he put some windows on the screen, made lines turn red and put a fake message about Trojans on the screen. His goal was to scare Bert and trick him into buying a "solution".

It is nonsense that Bert's virus scanner would not recognize Trojan horses. The idea that his computer would be home to an entire cavalry: just the same. But in the meantime, Bert felt bad. What has that criminal done? Maybe he stole files? Bert stores his photos and other important files on an external hard drive, which fortunately he disconnected at the beginning of the chat.

I discussed a number of scenarios with Bert. Perhaps the criminal copied Bert's email address book in order to present himself to Bert's contacts with insider knowledge or perhaps even to pose as Bert. Bert was smart enough to inform his closest contacts about this immediately after the incident and to impress on them that they should be on guard for strange messages. Another possibility is that the criminal wanted to copy photos and documents and then threaten Bert with publication. Fortunately, those files were inaccessible on the disconnected external drive. But the most likely scenario for me is that the criminal was only looking to make Bert pay for the Trojan horse killer offered. It came with a hefty price tag and is the easiest way to get money. The other scenarios require more from the criminal.

It makes sense that Bert is still not completely comfortable with the situation. I advised him to first run his old virus scanner on the disconnected PC. Step two is to re-connect the PC to the internet and run a free online virus scan (google 'online virus scan'). If that is all negative, Bert can also connect his hard drive and give it the same treatment. Finally, I suggested using a search engine other than Google, for example Startpage or DuckDuckGo . But to be honest, that is mainly for privacy reasons. Whichever you use: I prefer not to click on the sponsored search results, but to scroll through to the web results. Good luck, Bert!

And in the big bad world...

2023-10-06

Virtual violence

Image from Pixabay

A conference is successful if you have heard at least one thing that you had not previously considered. The longer you have been in the profession, the more difficult this is, but the ONE Conference has once again managed to let me have that experience. Not on a subject in my direct line of interest, but when choosing my parallel sessions I try to make a healthy mix of contributions that are interesting to me now, that seem fun/entertaining, and of which I think: hey, what’s that about? A warning in advance: this will not be a light-hearted blog. The contribution I am referring to was about violence in the virtual world, and that this violence can even penetrate into the real world.

You only need a TV to escape reality, although you are usually not really immersed in a fantasy world. In the cinema it becomes more realistic, especially if you are watching a 3D film (or one with even more dimensions). However, the virtual world that this presentation was about goes a few steps further: you wear a virtual reality headset and you may even wear a suit full of sensors and actuators, so that the computer feels you and can also make you feel things.

It was about that kind of virtual reality (a contradiction in terms?). And more specific: about violence in such an environment. Killing people in films and games is more or less socially accepted: in the westerns of my youth, quite a few cowboys and Indians were shot from their horses. Computer games, in which you have to shoot around to reach your goal, have also been popular for a long time; Back in the 1990s we had Wolfenstein 3D, in which I shot a lot of Nazis, while the blood dripped from the walls. These games have only become 'better' and a link has often been made between violent computer games and players who then started doing very wrong things in real life. I'm not going to rehash that discussion here.

The focus of Anne-Sophie Fritschij and Vien Germawi's presentation was on rape. In an artificial but very immersive world like the one outlined above, rape can have an effect on the victim comparable to physical rape, they explained. In this immersive virtual world, haptic feedback plays an important role – it is not just a matter of hearing and seeing, but also of feeling; you are almost literally immersed in that other reality. Reportedly, the number of sexual abuse cases in the metaverse, as this shadow world is known, is increasing at an alarming rate. There's even a game that revolves around rape (and I don't think it's necessary to mention its name).

The comparison the ladies made between virtual murder and rape revealed a clear difference, both in experience and in consequences. We don't make a fuss about murder in a game, but we deem rape morally reprehensible. An important difference was not discussed: murder in a game does not actually kill anyone, while with the current technology remote rape - or at least the sensation of it - is apparently possible. And that can have lifelong psychological consequences for the victim, according to the speakers.

In an earlier Security (b)log I wrote about the metaverse, with a quote from Winn Schwartau: “We are digitally terraforming the future cognitive infrastructure. We have ONE chance to get it right.” Schwartau painted a less than rosy picture of the metaverse. Fritschij and Germawi's presentation supplements that image with even more dark tones.

Aldous Huxley wrote Brave New World in 1932. I read the book half a century later, and last year I watched some episodes of a TV series based on this famous novel. Huxley describes a cinema in which you can watch a feely: a movie with not only 3D image and sound, but also feeling (by grasping two knobs on the arms of the seat). If a sex scene appears in a feely, the viewer's experience goes a long way. Huxley's fantasy from almost a century ago seems to be coming true. Or should I say: is threatens to become reality? Let us take Schwartau's call to heart.

(Possibly) no Security (b)log will appear in the next two weeks.

And in the big bad world...

the Red Cross has drawn up rules of war for civilian hackers.
an attack on a Spanish aviation company began with a fake recruiter on LinkedIn.
deepfakes of famous people are used to deceive you.
the US government's top 10 configuration errors are not very surprising.
it is not a good idea to program a password into an application. [DUTCH]
the conference has put a major burden on my agenda, so I don't have time to include any more links here.

2023-09-29

Creative solutions

Image from Pixabay

Professor Barnabas was kind enough to lend me his time machine. I take you back to the 1990s and we land at the Walterbos campus in Apeldoorn, the Netherlands, at the time the only location in this city where we had an office. The two highrise buildings were not yet there, nor were the underground passages – if you wanted to get from one building to the other, you had to go outside.

The company restaurant, which at the time we simply call the canteen, was located where tower H now stands, next to building G. The canteen had a tiled floor and a wooden ceiling; the laths were half an inch apart and above them was black cloth. At a certain point, that ceiling was replaced by a smooth, closed ceiling. It looked fresh, but had an unpleasant side effect: the acoustics of the canteen had deteriorated enormously. In the old situation, the sound was partly absorbed by the open ceiling, now everything was reflected. The canteen had become very noisy and that was certainly not pleasant.

A while later the floor was fitted with carpet tiles. I don't actually know whether that was an acoustic measure or whether this adjustment was planned anyway, but I always suspected that this was intended to compensate for the damage caused. The problem, which was caused by the adjustment of the ceiling, was solved on the floor. And it worked. But how well thought-out are carpet tiles in a canteen? Spilled tomato soup on a tiled floor is no problem. It becomes an ugly stain on carpet.

Back to the recent past. Last summer it was very hot, on occasion. So hot that the equipment in a technical room on our floor had a hard time. Such areas are equipped with additional access security – only authorized personnel can enter. But because melting equipment was not such a good idea, they had a mobile air conditioner brought in and placed in the doorway. The warm air from the technical room was blown into the office space. Problem solved. Or was it?

Followers of outside-the-box thinking may love those carpet tiles and the air conditioner. I personally tend more to solve problems where they arise. Poor acoustics due to a closed ceiling? Do something about the ceiling. Overheated technical room? Provide cooling inside that room. Especially if an outside-the-box solution has unpleasant side effects, such as a stained floor in the canteen. Or how about compromising the security of a technical room, in combination with heating up an office space which already was quite hot?

If the ideal solution is not quickly available, I understand why an alternative is chosen. But if you introduce new risks, you must take compensatory measures. Once upon a time, at that old Walterbos campus, summer also got just too hot. Then the doors of the computer center were opened, and a security guard was stationed at each door. No one was sitting at the open door on our floor. The irony of this happening where the security team is located...

Sometimes you cannot avoid solving problems somewhere other than at the source. Suppose your organization wants to put data in the cloud. But because that is someone else's computer, you see unauthorized access to your data as a risk, partly due to the fine American legislation and the fact that you almost by definition do business with the US when you go to the cloud (remember, this blog post comes to you from Europe). Then you can only do one thing: protect your data in such a way that it is of no use to anyone who gets their hands on it. Encrypt your data, and do so in such a way that no one except your organization has the key. If the cloud supplier does not have the key, he cannot hand it over, no matter how angry a government or law enforcement agency becomes.

Managing your key yourself makes things a lot more complex and you also get less value for your money, because the cloud supplier cannot provide certain functionality because they cannot read the data (think of all kinds of statistics that would be quite interesting to your organization). If you do it all yourself and get fewer functions, that will make a difference in the price, I hear you think. That's right, but in exactly the wrong direction: it will become alarmingly more expensive, as we experienced in a recent tender.

There may be no or fewer Security (b)logs appearing in the coming weeks due to a conference and days off/holiday.

And in the big bad world...

2023-09-22

Mr. Bean wants out

Image from Wikipedia

Britain has produced some great comedians, and Rowan Atkinson is undisputedly one of them – especially in the role of Mr. Bean, from the 1990s. This silent, cunning bumbler still makes me laugh.

Like in this video, in which he thinks the parking garage rate is a bit too high and thinks of all kinds of ways to get past the barrier for free. Now go watch that video first – spoilers follow.

To be able to leave the garage for free, the barrier must be raised. This usually happens when a car drives in or out. Mr. Bean waits like a predator for the right moment and eventually strikes successfully with his Mini. For my further story, it is a bit of a shame that he does not drive out right behind another car, but instead takes off via the entrance, forcing the car that wants to enter into reverse.

The word tailgating means that driving dangerously close behind another car. In addition, North America also has tailgating parties: parties where people gather at the open tailgate of their cars, barbecuing and drinking. But of course those are not the meanings I want to talk about here.

In security, we have adopted the term tailgating for unauthorized entry into a secured area by means of closely following someone, thereby free riding on that person's access rights. Take smokers, for example, who congregate at the back entrance of their business. When they are done, they go back inside. Just then someone walks up and acts like he belongs there, and there's a good chance they'll hold the door open for him, especially if he's carrying a large box and has his hands full. This practice is also called piggybacking.

I don't know all our offices, but where I have visited, electronic turnstiles were installed everywhere to prevent unauthorized persons. They open up after reading your valid ID card and they close behind you quite quickly. Almost impossible to sneak in with someone unobtrusively. And keeping the gate open for someone – if you would even consider doing so - is not really an option either. I do remember a building in Utrecht where the gates were open for months, if I remember correctly because they were incompatible with our access passes. Maybe they were still the gates of the previous occupant.

We also have entrances with revolving doors. Present your card, step into the revolving door and it gently sweeps you inside. One person at a time; if two persons step in, it starts beeping and turns the other way around, so you're outside again. How does that revolving door know that there are two people in it? Because of the weight. We have an anecdote going around about a revolving door that had to be adjusted because a big colleague kept getting spit out. I just hope that such an adjustment cannot be made from the outside by unscrewing a panel and turning a knob a little.

In an internal poll, no less than 78% of participants indicated that they are aware of the security risks of tailgating. Anyway, for that remaining quarter, and for those who did not vote: what are those risks? Suppose you arrive home, open your front door and notice that a stranger wants to come in with you. You probably don't like the idea. And that's how it works at work, too: you fundamentally don't want any unauthorized strangers inside. What is their purpose? Stealing, hacking, collecting information, who knows, even committing an attack? (Yes, sorry, I'm paid to think doom.)

Sometimes there is little you can do yourself about tailgating. When I arrive at my office by bike, the sliding gate opens when I present my card to the reader. Once I'm through the gate, it takes quite a while before it closes again. I often take advantage of this myself by cycling in behind a colleague. There are often smokers right outside that gate; Who tells me that there won't be someone there at some point who doesn't belong there at all? (Side note: could you please stand a little further away from the gate? I now always have to hold my breath when I'm waiting in front of the gate, because I don't want to inhale your smoke. Thanks in advance!)

Fortunately, our physical security consists of several layers. The fence may be a relatively weak barrier, but that's not all there is. The aforementioned gates, revolving doors, not to mention receptionists and security guards, do their best to keep unwanted people out.