Confirmed Report of Cyberwar Target List

A recent leak provided additional information about the Cyberwar target list maintained by the US government.

The existence of the list had previously been revealed by the administration. They released a high level fact sheet about the policy directive.

Given recent conflict between China and the US over cyber-spying, the release of this information could reduce the moral authority of the US to protest against Chinese attacks.

Sophisticated Android Exploit Spreads

Kaspersky Labs recently reported that it had analyzed a very sophisticated attack against Android devices. Backdoor.AndroidOS.Obad.a, or "Obad" for short, exploits unpublished exploits to install itself, remain undetected, and allow remote attackers to send commands to the device via SMS.

Besides installing itself and allowing remote attackers full access to the device, Obad downloads additional malware to the target device, runs up phone charges by sending SMS messages to premium-rate services, and spreads malicious files to other devices via Wi-Fi or Bluetooth connections.

It appears that the app can only infect devices which have been configured to allow apps to install from third-party sources.

Dan Goodin reports that Google has updated functionality to detect the malware and provide a warning to users when it is downloaded from an app source or browser.

Some security experts have warned of the danger posed by attackers who compromise a trusted developer's credentials and use them to upload malware to trusted download sites.

Fortunately, the attack does not appear to be widespread yet, based on analysis by Kaspersky.

Chinese End Hacking Hiatus

Chinese hackers associated with the PLA (People's Liberation Army) had dialed back their cyberattacks in the wake of US protests. This hiatus appears to have ended.

An embarrassing public exposure of a unit closely associated with the PLA had led to a temporary decrease in attacks. The Chinese government appears to have calculated that the downside of the publicity surrounding the attacks is outweighed by the benefits they are reaping.

This is likely to be a ongoing feature of the online world.

Data Protection Pointers

eWeek recently posted a slideshow describing several suggestions for planning a data protection policy in a Hadoop framework. The pointers apply to other data environments as well:

1. Account for data protection in the planning phase of the project. Take compliance and privacy concerns into account in the initial design and architecture.
2. Identify data elements that need special protection. What compliance or liability concerns apply to those elements?
3. Does the application need access to the complete, raw data set? Can the data be masked, obfuscated, or desensitized?
4. What encryption requirements do you have? What encryption solutions are available? Do they interoperate with the authentication methods in the environment?
5. Establish standards. It will be easier to keep all the data safe if it is kept in standard templates.

CIO Magazine estimates the value of a data breach at $184-$330 million. Given the cost to an organization's recommendation, there is a business imperative in placing adequate resources and thought behind protecting the data in our custody.

ColdFusion Vulnerability Nets Attackers SSNs and DL Numbers

A ColdFusion vulnerability whose patch was released in January 2013 was used by attackers against the Washington State Administrative Office of the Courts (AOC). The attackers compromised 160,000 Social Security Numbers and about a million drivers' license numbers.

Organizations may need to take a close look at their patch philosophies, since many organizations would have difficulty testing and deploying an application server patch in such a relatively short time window. This compromise highlights the importance of defense in depth, and the importance of protecting data with the enterprise architecture, not just the capabilities of a particular product.

Happy Mother's Day!

Federal Government to Default to Open Data

A recent executive order by President Obama mandates government agencies to default to a data policy of being open, publicly-available, and machine-readable.

Exceptions are allowed for information involving privacy, security, or confidentiality. There are obvious concerns that a government agency may not be as careful about privacy-related information as we would like.