Comments on: When The System Works, It Really Works! :) http://stateofsecurity.com/?p=766 Insight from the Information Security Experts Tue, 31 Aug 2010 17:42:12 +0000 hourly 1 http://wordpress.org/?v=abc By: Randy Abrams http://stateofsecurity.com/?p=766&cpage=1#comment-19560 Randy Abrams Fri, 28 Aug 2009 20:36:21 +0000 http://stateofsecurity.com/?p=766#comment-19560 Awesome Job. That the intended contact was not there made this a real world test and the employee who blew the whistle should be congratulated on a job well done. The fact that the alert went out means that many more people were educated against one potential attack vector. Awesome Job. That the intended contact was not there made this a real world test and the employee who blew the whistle should be congratulated on a job well done. The fact that the alert went out means that many more people were educated against one potential attack vector.

]]> By: Brent Huston http://stateofsecurity.com/?p=766&cpage=1#comment-19559 Brent Huston Fri, 28 Aug 2009 18:13:19 +0000 http://stateofsecurity.com/?p=766#comment-19559 Joe, #1 - I approved your link because I am a believer in free speech and opinion, but please, keep your tone respectful and if you would like to debate about an issue, that is fine, but please be respectful. #2 - I think the bad guys thing is clear. The NCUA was about to start the process for inspecting the code and would have traced the attack had we not immediately notified them of the testing. In fact, they had already issued the fraud alert so any wide scale attack would likely have been thwarted. #3 - Your mistake assertion is simply incorrect. The engagement was properly scoped, managed and performed. Certainly, some expected things happened during the incident handling process, but this is true more often than not. Quite simply, life is a chaotic system and we do our very best to control things, but the unexpected often occurs. Ask anyone who has ever been in a traffic accident about chaos. I do not see any way that we could have performed any differently than we did in this engagement. We had multiple levels of contact with the client and once those contacts were missed, we immediately stepped forward and alleviated the issue as soon as we knew about it. #4 - The entire process shows a successful capability to handle these threats. Everyone from the NCUA, to the media, to the security community performed wonderfully by spreading the word. Awareness was raised and we set the bar went higher for criminals trying to exploit these forms of attack (like in the "laptops for governors" attack currently in progress). So, at the end of the day, I extend my apologies to anyone who feels upset by the outcome, but we did everything we could to control the situation and proper safeguards were in place. Did the unexpected happen, sure it did, but I don't know how we could have avoided it. I am sorry that we caused a commotion, but I think, in the end, it was a positive outcome for everyone. I can't think of anything we would do differently, if we had it to do all over. In my mind, we communicated with the client, the NCUA and the folks involved as quickly and effectively as possible. Thanks for your input and feedback. I appreciate you being a reader and I value your input and right to an opinion. Joe,

#1 – I approved your link because I am a believer in free speech and opinion, but please, keep your tone respectful and if you would like to debate about an issue, that is fine, but please be respectful.

#2 – I think the bad guys thing is clear. The NCUA was about to start the process for inspecting the code and would have traced the attack had we not immediately notified them of the testing. In fact, they had already issued the fraud alert so any wide scale attack would likely have been thwarted.

#3 – Your mistake assertion is simply incorrect. The engagement was properly scoped, managed and performed. Certainly, some expected things happened during the incident handling process, but this is true more often than not. Quite simply, life is a chaotic system and we do our very best to control things, but the unexpected often occurs. Ask anyone who has ever been in a traffic accident about chaos. I do not see any way that we could have performed any differently than we did in this engagement. We had multiple levels of contact with the client and once those contacts were missed, we immediately stepped forward and alleviated the issue as soon as we knew about it.

#4 – The entire process shows a successful capability to handle these threats. Everyone from the NCUA, to the media, to the security community performed wonderfully by spreading the word. Awareness was raised and we set the bar went higher for criminals trying to exploit these forms of attack (like in the “laptops for governors” attack currently in progress).

So, at the end of the day, I extend my apologies to anyone who feels upset by the outcome, but we did everything we could to control the situation and proper safeguards were in place. Did the unexpected happen, sure it did, but I don’t know how we could have avoided it. I am sorry that we caused a commotion, but I think, in the end, it was a positive outcome for everyone. I can’t think of anything we would do differently, if we had it to do all over. In my mind, we communicated with the client, the NCUA and the folks involved as quickly and effectively as possible.

Thanks for your input and feedback. I appreciate you being a reader and I value your input and right to an opinion.

]]> By: Brent Huston http://stateofsecurity.com/?p=766&cpage=1#comment-19558 Brent Huston Fri, 28 Aug 2009 17:56:02 +0000 http://stateofsecurity.com/?p=766#comment-19558 Mike, thanks for the comment. Actually, the NCUA seemed OK with it in our discussions. It represents a valid threat vector that attackers might exploit. In fact, in email form, attacks using the same methodology have been logged for quite some time. The new "old school twist" was the delivery via physical mail. As you know, other forms of physical attack, such as dropping USB keys and the like on the premises have been standard for some time. This is simply another extension of manipulating un-validated trust that is likely to exist. While the press attention was unexpected, it shows that the alert process is functional and effective. I see this as a large scale win for credit unions, the NCUA and information security, in general. It has really raised awareness of social engineering attacks and set the bar higher for criminals expecting to exploit these issues. Mike, thanks for the comment. Actually, the NCUA seemed OK with it in our discussions. It represents a valid threat vector that attackers might exploit. In fact, in email form, attacks using the same methodology have been logged for quite some time. The new “old school twist” was the delivery via physical mail. As you know, other forms of physical attack, such as dropping USB keys and the like on the premises have been standard for some time. This is simply another extension of manipulating un-validated trust that is likely to exist. While the press attention was unexpected, it shows that the alert process is functional and effective.

I see this as a large scale win for credit unions, the NCUA and information security, in general. It has really raised awareness of social engineering attacks and set the bar higher for criminals expecting to exploit these issues.

]]> By: Joe Bloe http://stateofsecurity.com/?p=766&cpage=1#comment-19557 Joe Bloe Fri, 28 Aug 2009 17:42:06 +0000 http://stateofsecurity.com/?p=766#comment-19557 What do you mean, "if we had been bad guys we would have been busted?" This is part of your "standard penetration test" is all fine and well. I like a little social engineering myself. But you clearly F'd up. You didn't account for time out of office/vacation and you didn't have appropriate contact information to get a hold of your "get out of jail" contact, who could have nipped this in the bud. Perhaps you should included some lessons learned here, as I'm confident the upper management of said CU aren't real happy w/ their name being dragged about, nor was the NCUA for going into crisis mode. The fact that the media jumped all over it is a testiment to their willingness to report anything w/o getting the facts. If you really had control over this situation, the outcome would have been different. The test could have been completed, the alarms sounded, and the minor freak-out avoided. - Joe. What do you mean, “if we had been bad guys we would have been busted?” This is part of your “standard penetration test” is all fine and well. I like a little social engineering myself.

But you clearly F’d up. You didn’t account for time out of office/vacation and you didn’t have appropriate contact information to get a hold of your “get out of jail” contact, who could have nipped this in the bud. Perhaps you should included some lessons learned here, as I’m confident the upper management of said CU aren’t real happy w/ their name being dragged about, nor was the NCUA for going into crisis mode. The fact that the media jumped all over it is a testiment to their willingness to report anything w/o getting the facts.

If you really had control over this situation, the outcome would have been different. The test could have been completed, the alarms sounded, and the minor freak-out avoided. – Joe.

]]> By: Mike http://stateofsecurity.com/?p=766&cpage=1#comment-19556 Mike Fri, 28 Aug 2009 17:29:24 +0000 http://stateofsecurity.com/?p=766#comment-19556 I wonder if spoofing NCUA is the best idea. I know that I would not be happy if I found out that a company was pretending to be us to fool someone into responding to a social engineering attack. I wonder if spoofing NCUA is the best idea. I know that I would not be happy if I found out that a company was pretending to be us to fool someone into responding to a social engineering attack.

]]>