Within the Heartbleed Bug

Only a few months ago, the Hearbleed OpenSSL bug was discovered.




We are still learning about the countless encrypted transactions that left your accounts vulnerable to theft.
When computers talk to each other, it is called a heartbeat.  Because of a coding mistake, the Heartbleed bug was born.

Lets say there is a banking transaction:  The client (you) sends its heartbeat to the server (your bank) and the server hands it back to you.  So if something goes wrong with the transaction, the other party will know because the heartbeats get out of sync.

It’s like a cassette tape breaking because one of the spindles stopped working correctly.

How it happened

The actual breach happened all because of the following code:

memcpy(bp, pl, payload);

To explain, the memcpy is a command that copies data, and it requires three pieces of information to do so. 
The first set of information is the destination of where the data needs to be copied.  The second is the exact location of the data that needs to be copied.  The third set is the amount of data the computer is going to find when it goes to make the copy.



The bp is a place on the server computer, pl is where the actual data the client sent as a heartbeat is, and payload is the number that says how big pl is.

The bp, which is where the data is going to be copied, is full of the data sitting in the part of the computer before.  Although, the computer treats it as if it were empty because the data has been marked for deletion.

When memcpy takes the data from pl and puts it in bp, it covers up all the old data in bp.

Everything that used to be in bp is destroyed and filled up with the pl data.

If payload says that pl is 64 KB but it only has 0 KB,  memcpy creates a 64 KB sized open space at bp that’s full of garbage data.  None of the bp old data gets overwritten because there’s nothing to replace it since pl is actually empty.

Meaning whatever old data was sitting in bp prior to the heartbeat gets passed back to the client.  Sometimes the data is irrelevant and sometimes its your banking password.

The Heartbleed bug has been fixed but the vulnerability has existed for a decade.  Who knows how much data was exploited.

Do you have maximum protection on your PC?  Is your antivirus out-of-date?  Let us help you protect yourself from the many vulnerabilities that live on the net.  [P] 619-325-0990

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet, “Like” us on Facebook or add us to your circle on Google+.

References:

Aguilar, Mario
Internet Vulnerability Left Encrypted Data Exposed For 10 Years – GIZMODO
http://gizmodo.com/internet-vulnerability-left-encrypted-data-exposed…
Published: June 5, 2014

Limer, Eric
How Heartbleed Works: The Code Behind the Internet’s Security Nightmare – GIZMODO
http://gizmodo.com/how-heartbleed-works-the-code-behind-the-internets-se…

What is Heartbleed and what you can do about it.

The Heartbleed Bug is a vulnerability in the OpenSSL cryptographic software library.

This allows stealing from protected information by the SSL/TLS encryption used to secure the Internet.
SSL/TLS provides communication security and privacy for email, instant messaging (IM), web, and virtual private networks (VPNs).

The Heartbleed bug gives access to anyone that intends to read the memory over the Internet of systems protected by the vulnerable versions of the OpenSSL software.

Secret keys are compromised that are used to verify encrypted traffic, including names, passwords, and private information of the users content.

 

What to do about the leak

Affected sites include: Google, Gmail, YouTube, Facebook, Tumblr, Yahoo and Dropbox.  If you use any of these sites, it if strongly recommended for you to change your passwords immediately.

If you are running a vulnerable version of OpenSSL, you are at risk.  Fixed OpenSSL has been released and is deploy-able.

If you use password protection sites that hold all your passwords in a single place like LastPass, please update your passwords there as well.

Attackers are able to eavesdrop on communications and easily steal data.  User-ids, passwords, credit-card numbers, and everything you place online is open for hackers to access.

Google told MailOnline: “The security of our users’ information is a top priority.  We fixed this bug early and Google users do not need to change their passwords.’

While some experts are advising users to change all their passwords across every site they have an account for.

CNet has an updated list, Heartbleed bug: Check which sites have been patched, for the 100 most popular Web sites.

When creating passwords, always use the two-factor authentication.  The extra step is tremendously safe and worth it.

You can also follow these steps to clear your browsers’ cache, cookies, and history:
Chrome:

• In the browser bar, enter: chrome://settings/clearBrowserData
• Select the items you want to clear. For example, Clear browsing history, Clear download history, Empty the cache, Delete cookies and other site and plug-in data.

Firefox:

• From the Tools or History menu, select Clear Recent History.
• From the Time range to clear: On the drop-down menu, select the desired range; to clear your entire cache, select Everything.
• Click the down arrow next to “Details” to choose which elements of the history to clear. Click Clear Now.

Internet Explorer 9 and higher:

• Go to Tools (via the Gear Icon) > Safety > Delete browsing history….
• Once there, choose to delete Preserve Favorites website data, temporary Internet files, and cookies.

There is no quick fix for Heartbleed, take time and change your passwords.  That is the best preventative measure you can take.

You can check a website here to see if they’ve patched the hole.

If you are still unsure on what to do, give us a call today! Don’t go through the weekend not knowing if your are secure or not, call 619-325-0990.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

References:
How to protect yourself in Heartbleed’s aftershocks – ZDNet
http://www.zdnet.com/how-to-protect-yourself-in-heartbleeds-aftershocks…
How to recover from Heartbleed – ZDNet
http://www.zdnet.com/how-to-recover-from-heartbleed…
The Heartbleed Bug – Heartbleed
http://heartbleed.com/
Heartbleed was an accident: Developer confesses to causing coding error and admits its effect is ‘clearly severe’ – Mail Online
http://www.dailymail.co.uk/sciencetech/article-2602277/Heartbleed-accident-Developer-confesses-coding-error…

The Industry’s Fastest Next-Generation Firewall

 

PA-7050 is the Fastest Next-Generation Firewall that Delivers Exceptional Performance

With the next-generation firewall, IPS, AV and WildFire active on all traffic, the PA-7050 brings performance at speeds with higher than alternative offerings.

This performance has superior consistency and gives organizations high network performance with next-generation firewall security.


 


Data traveling across enterprise networks are growing at a rapid rate, and enterprises need to ensure that data moves as fast as possible to maintain business productivity. The object is to apply security throughout the network to protect against sophisticated cyber attacks. The attacks hide in plain sight, while using routine applications to penetrate exterior defenses.

 

When inside the network, the attack acts like regular traffic while stealing targeted data via applications like FTP, webmail or cloaked within SSL. Most firewalls use a simple signature-based protection mechanisms masked as next-generation firewalls.

Signature-based protection mechanisms masked as next-generation firewalls cannot safely enable applications. They will block them, but cannot deliver sufficient performance with the security threats enabled. Palo Alto Networks addresses the challenge head-on with the PA-7050, a dynamic, easy-to-extend and manage next-generation firewall that is designed from the ground up to deliver performance consistency with next-generation security controls enabled.

This inception, set gold standards for high performance next-generation firewall that is structured from the ground up. This protects digital assets by identifying and enabling all applications, including those encrypted with SSL while blocking unknown threats. The PA-7050 is suited for:

• Data centers with threat prevention at 100Gbps or more
• Internet gateway where visibility and control over all application and protection from all critical threats
• Internal network segments, where isolation of critical data and business functions are required

Palo Alto Networks is leading a new era of cybersecurity by protecting thousands of enterprise, government, and service provider networks from cyber threats.

The security platform enables business operations and delivers protection based on what matters most in today's computing environments of applications, users and content.

 Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet, “Like” us on Facebook or add us to your circle on Google+.  

 References:

 Palo Alto Networks Launches the Industry’s Fastest Next-Generation Firewall http://www.redorbit.com/news/technology/1113067382/palo-alto-networks-launches-the-industrys-fastest.../

PA-7050: The Industry’s Fastest Next-Generation Firewall - Palo Alto Research Center Blog http://researchcenter.paloaltonetworks.com/2014/02/introducing-pa-7050-industrys-fastest-next-generation-firewall/

The Biggest Security Stories of 2013

As the year ends, lets take a look at all the security activity that has taken place in 2013.  

Information security is priority for companies.  Security threats and data privacy have been a major concern, there have been big stories of success and failures in the tech industry.
Here are some of cybersecurity’s highs and lows:

Apple Biometrics

Apple launched the iPhone 5s with a fingerprint sensor for identification.  Biometrics has been adopted by smartphones but have been used for years on Corporate laptops as an alternative form of identification.

Companies Embrace Two-Factor Authentication

LinkedIn, Twitter and Evernote launched a two-factor authentication feature.  Providers require stronger passwords including encryption of customers passwords stored on their servers.

Cryptolocker

Cryptolocker ransomware is a high-grade encryption against victim’s files which is spread to network-based storage applications and cloud-based backup services.
Bitcoin payments are demanded to retrieve keys needed to unlock the files from the infection.

Huawei Turmoil

China-based Huawei is under surveillance, following concern from the U.S.  that its hardware components could contain back-door access for Chinese spies.

Cisco’s Sourcefire

Sourcefire founder and CTO Martin Roesch  leads security product innovation under Cisco.  Sourcefire’s intrusion prevention system conducts real-time traffic analysis, sniffing and packet logging.

FireEye is Public

At the core, FireEye’s technology is a virtualized sandbox. With cloud-based mobile and email protection service, and detects suspicious files for malware threats, FireEye is the next generation firewall.

Java Attacks

The Java platform saw an increase of attacks targeting weaknesses in the programming language.  Java vulnerabilities accounted for more than 90 percent of attacks in 2013.

Adobe Source Code Breach

More than 35 million customers passwords were exposed as well as the product source code.  Investigators are still figuring out the cause of the massive fallout.

 

Mandiant APT1 Report

The Mandiant APT1 report exposed China as the source of cyberspionage activity towards the U.S.  The report discovered attacks designed to steal intellectual property from many government agencies and defense contractors.

Edward Snowden’s Leaks

The government contractor stole thousands of classified documents outlining the extent of the National Security Agency’s surveillance.  Cell phone metadata collection, used encryption algorithms to gather massive amounts of Internet communication from major firms.
Lets hope next year tech industries will have more achievements than defeats…

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+

References:
The 10 Biggest Security Stories Of 2013 – CRN
http://www.crn.com/slide-shows/security/240164781/the-10-biggest-security-stories…

Why is (HTTPS) important on Cyber Monday?

(HTTPS) stands for Hypertext Transfer Protocol Secure. This means the computer network is secure and uses encryption keys to exchange data between the client and server.

Seeing HTTPS in your web browser shows you the site is authenticated and you are safe against man-in-the-middle attacks, such as phishing or malicious sites.

Many consumers are online participating in Cyber Monday shopping this second. Cyber Monday is the perfect time for cybercriminals to take advantage of ambitious shoppers paying more attention to getting “the deal” instead of watching out for their security.

Most websites begin with http:// but if you are purchasing something and entering private data, the browser should always contain a https://. If you don’t see the “s” then you can not be certain your information is secure.

Also a “lock” symbol should appear in the lower-right corner of the check-out page.

It is warned there will be a 60 percent spike in cyber attacks this shopping season. Payment fraud, mobile and online account hijacking, and Denial of Service attacks are some issues that will come along with Cyber Monday scams.

Key Points to Remember on Cyber Monday:

1. Don’t Click on Pop-up Ads – Malicious pop-up ads are one of the largest threats to web shoppers.
2. Keep Software Up-To-Date -  Update your software as soon as new features become available.  Updating once a week is advised to avoid security holes.
3. Use Strong Passwords – Never use birthdays, family names, or consecutive numbers for passwords.  If your password is easy to remember, it is easy to hack.  Check out our guide:  How to Create a Secure Password.
4. Install Antivirus and Anti-Spyware Software – When shopping, you don’t want others to track the websites you’ve visited.  Here are the 5 Best Free Antivirus Software Options.
5. Enable “Timeouts” on Mobile - If you are a consumer that is doing your holiday shopping on your mobile phone, enable a lock screen password, in case your device is lost or stolen.
6. Use a Secure Connection – Any online financial transactions should be made on a private Wi-Fi connection.  Coffee shops and library’s are vulnerable to attacks.
7. Avoid Email Advertisements – Don’t click on e-mail advertisements and promotions from your inbox.  Go directly to the site to avoid fake links.
8. Shop at Companies You Know - Check the rating and number of sales for sites, make sure they have a good return policy and contact information.  You can check the company’s legitimacy through the Better Business Bureau.
9. Use Credit, Not Debit – Using your credit card for purchases gives you more insurance protection on fraudulent claims.  
10. Ensure Your Site Is Secure – Be sure the URL begins with https:// as oppesed to http:// and has a lock in the browser’s search bar.
11. Be Wary of Charity Sites – Check the legitimacy of charity websites, there are a lot of phony charities aiming to take your money to only help themselves.
12. Check You Location and Privacy Settings – Turn off the location sharing on your device.  Many apps and websites will automatically share your GPS location by default.
13. Check Your Statements Frequently - Some hackers will make small purchases on your credit card to avoid detection.  Stay on top of your account and check your statements often.
14. Add Browser Extensions and Security Apps -  Pop-up blockers and malware detection extensions will give you extra security.  Use some of these free tools: 8 Best Free Tools for Internet Security.

Be sure to follow us on Twitter at @hyphenet or “Like” us on Facebook. You know you want to.

References:
Http vs. Https: What’s the difference? – MSDN
http://blogs.msdn.com/b/securitytipstalk/archive/2011/04/04/http-vs-https-what-s-the-difference.aspx
14 Tips to Avoid Cyber Monday Scams – Mashable
http://mashable.com/2013/11/25/cyber-monday-security/

How a Casual Web Browsing Session Can Lead to Malware Infections

So there I was, sitting at home with my computer reading news articles, skimming over the latest tweets from those I’m following on Twitter and checking out the blog of one of the reality stars on a television show I was watching.

I wasn’t downloading anything, visiting any “shady” sites or anything of the sort. I was just casually surfing the internet in my Monday evening downtime shortly before crashing for the night.

So you can imagine how surprised I was when an ESET alert popped up, notifying that it had discovered malware – identified as HTML/ScrInject.B.Gen (Microsoft detects it as JS/BlacoleRef.A) to be specific – on one of the sites I was browsing.

For those who are unaware, HTML/ScrInject.B.Gen is a Trojan that injects malicious iFrames into websites in order to conduct drive-by-downloads on unsuspecting users.

Whenever a user visits a website that’s been compromised, the hidden iFrame will load a third-party site that will attempt to exploit any system vulnerabilities in order to download and install malware onto the visiting machine.

Thankfully, I was running antivirus software and so the malware was caught, but my experience is a huge reminder how important it is for users to take the proper steps to protect their PCs.

Even though you may be browsing websites that SHOULD be safe to visit, the fact of the matter is websites get hacked all the time and a lot of the time site owners don’t even realize their site has been compromised until it’s pointed out to them.

By that time, it’s already too late.

How to Keep Your PC Safe While You Surf the Web

If you’re curious on how you can do your best to prevent your PC from being infected by whatever malware is roaming around, here are a few tips that may help:

• Keep your system’s operating system up-to-date. Many users don’t realize the importance of updating Windows whenever Microsoft issues patches for system vulnerabilities – and cybercriminals love taking advantage of this. Don’t leave yourself open for infection when it could easily be prevented.


• Make sure you install updates for installed software. While it’s important that you keep your OS current, it’s also critical that you don’t forget to patch whatever software that’s installed on your PC. So make sure your browser is up-to-date, along with Java, Adobe Flash, Adobe Reader and Adobe Acrobat as those are programs commonly exploited in drive-by-download attacks.


• Consider disabling Java browser plug-ins or uninstalling it altogether. Do you really need Java to be installed on your PC? If you don’t, then it may be best to just uninstall it completely from your computer. If you do need it – say for your bank’s website – then dedicate one browser to that task and disable the Java plug-in for your remaining browsers.


• Look into the best security plug-ins for your browser – and use them!  There are a number of plug-ins that will help you secure your browser and ultimately provide you with the best web experience possible. For instance, Firefox users enjoy NoScript since it allows you to control which scripts execute on a website, which is something that can come in handy if you happen to visit a site rigged with malicious JavaScript. Do a little research and figure out what’s recommended for your browser of choice.


• Always run antivirus software. You never know what’s going to be lurking on that next website you visit or hiding inside that file you downloaded, so always make sure you’re running antivirus software and keep the virus definitions up-to-date.


• Remain vigilant and use common sense. Make sure you know how to spot a malicious image link when you see one and if a link looks suspicious, don’t click on it. Only download files from trusted sources and scan all downloaded files.

Do you have any other tips? Feel free to share them below!

Happy Surfing!

Photo Credit: Bull3t

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.