Mobile Malware Takes Victims by Surprise

Malware writers behind Koler, a bad app that attacks Android devices, have upped their game with a new variant of the pernicious program.

In its original version, Koler hijacked phones it landed on and wouldn't set them free until a ransom was paid. This latest strain of the malapp also does the ransomware thing, but it takes its malignancy a step further.

"This version self-replicates," Denis Maslennikov, a security analyst withAdaptiveMobile, told TechNewsWorld. "This is the first time we've seen self-replicating ransomware on Android."

After a user downloads the new Koler to a phone, the software commandeers the mobile's address book and spams everyone in it -- only it doesn't look like spam to the contacts because the SMS message is coming from a trusted source.

The message tells targets that a photo page has been created about them on the Web and includes a link to the page. After landing on the page, a target is directed to download and install a photo viewer to see the images. Following those instructions will infect the target's phone with Koler.

Toothless Threats

"This is big jump in Koler's propagation mechanism," Maslennikov said. "Before it was just hiding on websites. Now it's actively spreading to all your friends."

Although mobile ransomware can be frightening to someone unfamiliar to its workings, the malware is tame compared to its computer counterpart.

For example, Koler claims to encrypt all the data on a phone. However, it doesn't do that, so the data is always recoverable from the phone without any dependence on Web predators.

Moreover, removing the malware is relatively easy. You can reboot Android in safe mode and kill the malignant program using standard application-removal tools.

"If you reboot the phone normally, it's always going to come back into the ransomware," said Cathal McDaid, AdaptiveMobile's head of data intelligence and analytics.

"The typical user isn't going to know that, so they may go to extremes and do a factory reset, which will work as well -- but they will lose all their data," he told TechNewsWorld.

Bell Tolling for Passwords

While complaints about passwords as a way to authenticate users abound, progress on finding a substitute for them has been glacial. Last week, though, there were signs that was changing.

Microsoft plans to build two-factor authentication into the next version of its desktop operating system, Windows 10, ZDNet reported. It will be based on standards developed by the FIDO Alliance.

Owners of any device running it will be able to enroll the device as "trusted" for the purpose of authentication, according to the report.

In addition, the owner creates a PIN for the device. The PIN can be any combination of letters and numbers.

If PINs are compromised in a data breach, it won't do the thieves much good. When they try to use them to obtain online services, they won't have the associated devices to authenticate their identity. Conversely, if devices are stolen, the thieves won't have the PINs for authentication.

Google Dongle

Meanwhile, Google also floated a two-factor authentication scheme using a USB security key.

Google already has two-factor authentication via SMS messaging, but the USB approach will give its users another option.

Initially, the key will work only with Google's Chrome browser. With the key, you don't have to fuss with any codes. You plug the key into a USB port, wait for a prompt, and tap the key to access your Google accounts.

The key also incorporates authentication technology from the FIDO Alliance.

"The idea here is to move away from just using a password to log into your email, your system, your network," Aryeh Goretsy, a researcher with Eset, told TechNewsWorld.

"What we've seen in the past is a bunch of attacks where people's accounts have been compromised," he said. "So the goal here is to remove the weakest link, which is the password."

Making NFC Respectable

Near-field communication has been around for some time, but it has failed to capture a lot of consumer interest or confidence in its ability to secure mobile transactions.

For example, by a two-to-one margin, consumers give lower security ratings to NFC transactions than those performed with magnetic strip cards, suggests a survey released last week by Phoenix Marketing International.

Apple might be able to change that perception with its Apple Pay system, however. That's because the scheme depends on more than NFC alone for security.

"Apple delayed committing to NFC for a long time so when it entered the market, it could do so with a whole security platform," said Greg Weed, PMI's director of card research. That platform included a secure element chip inside the phone and a fingerprint scanner outside it.

Before Apple Pay, merchants, vendors and card issuers debated what kinds of rewards and enticements were needed to get consumers to use NFC devices. Apple Pay has changed that.

"What it did is take the idea of security and make it the benefit of the platform," Weed told TechNewsWorld. "That's changed the conversation."

DDoS attacks increase almost four times in size and volume in just one year

Distributed denial of service (DDoS) attacks have seen a four-fold, year-over-year increase in both size and volume, according to a report from cloud services provider Akamai.

The company, which releases quarterly reports on global threats, claimed that in the third quarter alone, it had to mitigate 17 attacks greater than 100 gigabits per second (Gbps) with the largest measured at 321Gbps. 

Further reading

• DDoS attacks hit 41 per cent of organisations in the past year

• DDoS attacks: A third of UK companies estimate losses of over £240,000 per day

• CloudFlare gives details of 'largest ever DDoS attack' and warns of worse to come

• Sony's PlayStation Network hit by DDoS attack

• UK government used DDoS attacks against Anonymous, Snowden documents reveal

• Evernote latest to be struck by DDoS attack

• Education sector is fastest growing for DDoS mitigation - DOSarrest

"DDoS attack size and volume have gone through the roof this year," said John Summers, vice president of the security business unit at Akamai. Summers added that Akamai didn't witness any attacks bigger than 100Gbps in the same quarter in 2013, but it did experience six in the second quarter of 2014.

Overall, there was a 22 per cent increase in total DDoS attacks and a 366 per cent increase in average peak packets per second in the third quarter of 2014, compared to the same quarter a year earlier. 

According to Akamai, the attack campaigns marked an 80 per cent increase in average peak bandwidth in the third quarter compared to the previous quarter - and a four-fold increase from the same period a year ago.

It said that more sophisticated, multi-vector attacks had "become the norm", with more than half (53 per cent) using multiple attack vectors.

Akamai attributes the increase in multi-vector attacks to increased availability of attack toolkits with easy-to-use interfaces, enabling more, but less sophisticated people to launch attacks, as well as a growing DDoS-for-hire criminal industry.

Meanwhile, larger DDoS attacks have come to fruition as a result of the use of a wider base of compromised devices, including smartphones, customer-premises equipment, home cable and DSL modems, tablets and even wearable technologies that have helped to expand DDoS botnets, the report claimed.

Aside from DDoS attacks, the Akamai PLXsert Q3 2014 State of the Internet Security Report found that phishing attacks were also prominent.

DIY USB password generator

Electronics, V-USB tutorials

 238 Comments or trackbacks

Having done half a dozen V-USB tutorials I decided it’s time to whip up something cool. As USB keyboards were an area untouched, I decided to make a small USB HID keyboard device that types a password stored in EEPROM every time it’s attached. A new password can be generated just by tabbing CAPS LOCK a few times (4 times to start password regeneration and one tab for each password character generated, 10 is the default password length). Below you can see the device in action:

The place I work at requires me to change my password every few months so this would be one way to skip remembering a new password altogether (as long as I remember to write it down before regenerating a new one so password can be changed :).

What is inside?

The device is powered with a simplified version of the hardware I used in my ATtiny85 USB tutorial – I stripped away the LCD, reset pullup and both capacitors. If you’re better in cramming components inside enclosures I suggest adding at least a 0.1 uF capacitor between VCC and GND, but it seems to work fine even without it:

The enclosure was graciously donated by an old 512 MB flash drive. I couldn’t make myself to break the USB connector from the circuit board inside, so I stripped appart a short USB cable instead (shown on left):

After some thinking and iterative soldering, I managed to cram everything on a tripad veroboard with 2×8 pads with the following initial setup:

I soldered the connector first, then the zener diodes, then resistors and jumpers, and finally VCC, GND and the ATtiny itself. I used the following tricks to make all ends meet:

• D+ zener diode goes to the pad under ATtiny that is connected to GND pin
• After the D- zener diode, only 1 pad is left for 2k2 pullup and 68 ohm resistor, so I used a jumper wire to the next pad
• 2k2 pullup goes to a pad connected to ATtiny VCC
• VCC goes to the pad under the ATtiny using a black jumper wire
• I soldered the D+ 68 ohm resistor to a wrong tripad, so I used another jumper wire just barely visible behind the top left black jumper wire for GND

I was pretty satisfied the result and the fact that it actually worked! The board did not initially fit into the very snug space in the plastic enclosure, so I had to use a Dremel to trim its insides a bit, but after that, everything snapped right back (click for larger versions):

Update: For those who are building this project – I recommend you first build it on a breadboard, and only when you have it working, solder it to a veroboard. Here are two additional, extra-large pictures of the configuration I used to help you in the component layout:

Software

The device presents itself to the computer as a USB HID keyboard. To enable communication to the device, it is a boot-compliant keyboard that can receive LED status changes from the computer. HID descriptor is from Frank Zhao’s USB business card example and I also looked at Frank’s code to understand how LED state is sent to the device (in short, PC sends a control message with 1 byte of data, the LED state bit mask).

The code is mostly based on my USB HID mouse example except for the usbsconfig.h and HID descriptor changes required to implement a boot keyboard. I’ve documented the code but here are some highlights if you want to understand it better:

• PASS_LENGTH defined in the beginning controls the length of generated passwords
• SEND_ENTER can be defined to 1 if you want the device also to send ENTER after typing the keyboard
• measuring_message and finish_message contain the messages that are displayed when generating / saving a new password
• buildReport() is called by the program main loop to send keypresses to PC one by one – it translates characters in messageBuffer to USB key codes on the fly
• usbFunctionWrite() is implemented to receive the 1-byte LED state from PC – it calls caps_toggle()function every time the LED state changes
• generate_character() is used to return random keypresses – it is currently written to return alphanumerics, hyphen and underscore (64 symbols make it simple to select one so each has equal chance of being selected without additional logic)
• caps_toggle() does the caps-lock counting and password generation/saving

I’ve packed the source files with the schematic, critical pictures and a Makefile. In addition to “make flash” you of course need to update the fuse bits to use the PLL clock source – see details from my previous tutorial for that. I also very strongly recommend testing the device using a breadboard before soldering it, because otherwise reflashing will be a major pain.

And of course, if you build it, try it at your own risk – and remember that once you reprogram the password, nothing will be able to restore it. I recommend storing passwords generated with the device to a safe place just to be sure.

Update: Getting it from SparkFun

I found out yesterday that SparkFun is carrying an almost identical piece of hardware, the AVR Stick. So if you order one and reprogram it with this firmware (pin configuration in usbconfig.h needs to be updated in that case), you can avoid some soldering (although not all, you’ll likely need to solder in the programming header).

I asked SparkFun if they’d be interested to make a “2.0” model of their AVR Stick with actual USB connector and enclosure to go with the package, and my password generation firmware preloaded. If you think that’s a good idea, now would be a great time to send them feedback. I’d also be interested in covering additional hacks and tutorials with such a device. :)

Update 2: Indiegogo project

Alvin Chang is currently (December 1st 2012) running a Indiegogo project to build a device very similar (and inspired by) my DIY version. In case you’re interested in getting a ready-made version, be sure to check Mr. Chang’s project out: Aladdin: The Key to Your Computer.

Pirate Bay introduces Web browser to elude censorship

The Pirate Bay has introduced its own browser, which can be used to circumvent censorship and blockades.

The PirateBrowser is a simple, one-click, pre-configured Firefox browser that makes The Pirate Bay and other blocked sites instantly available and accessible in countries where the site is blocked, the torrent search website said in a blog post over the weekend.

PirateBrowser uses Vidalia, a cross-platform graphical controller for the Tor software that allows users to start and stop the Tor anonymizing network.

This client is bundled with Mozilla’s Firefox portable browser with the FoxyProxy addon, a set of proxy management tools for Firefox, Google Chrome and Internet Explorer that bypass content-filtering in certain countries.

Combined with some custom adjustments, the PirateBrowser allows users to “circumvent censorship that certain countries such as Iran, North Korea, United Kingdom, the Netherlands, Belgium, Finland, Denmark, Italy, and Ireland impose onto their citizens,” according to the PirateBrowser site.

The launch of the browser that celebrates the 10th anniversary of The Pirate Bay is only intended to circumvent censorship, The Pirate Bay said. People who want to surf the Web more securely may want to try a virtual private network (VPN) service like Privacy.io, it said.

PirateBrowser is available for Windows on piratebrowser.com. Linux or Mac versions were not announced.

China targets iCloud users with cyber attacks after iPhone 6 and iPhone 6 Plus launch

The Chinese government is targeting Apple iCloud customers with sophisticated man-in-the-middle cyber attacks following the local launch of the iPhone 6 and iPhone 6 Plus, according to GreatFire.org.

GreatFire.org warned in a public post that the attacks are designed to collect vast amounts of information from iCloud users.

"This is clearly a malicious attack on Apple in an effort to gain access to usernames and passwords and consequently all data stored on iCloud such as iMessages, photos, contacts, etc," read the post.

"This attack is nationwide and coincides with the launch today in China of the newest iPhone."

The iPhone 6 and iPhone 6 Plus launched in China on 17 October. Greatfire.org said the reason for the attack remains unknown, although it is likely to be part of a blanket online surveillance campaign.

The Chinese government has been accused of attempting to hack numerous technology firms, including Google, Microsoft and Yahoo. Google famously withdrew from China in 2010 after allegedly being ordered to censor search results.

It is currently unclear whether Apple is aware of Greatfire.org's report and at the time of publishing the firm had not responded to V3's request for comment.

This could be due to Apple's ongoing policy of not discussing security issues until they have been resolved.

Greatfire.org said it is currently unclear how successful the attacks have been, but noted that existing iPhone encryption technologies would at the very least hamper the Chinese government's surveillance.

"Ironically, Apple increased the encryption aspects on the phone allegedly to prevent snooping from the NSA. However, this increased encryption would also prevent the Chinese authorities from snooping on Apple user data," read the post.

"It is unclear if Apple made changes to the iPhones they are selling in mainland China. However, this attack may indicate that there is at least some conflict between the Chinese authorities and Apple over some of the features on the new phone."

In the mean time, Greatfire.org called for Chinese iPhone users to take a variety of protective measures, including surfing the internet using a virtual private network and enabling two-factor authentication on their iCloud account.

Greatfire.org is one of many organisations to accuse the Chinese government of hacking Western businesses. The FBI sent a warning on 16 October to local firms about the threat of security attacks coming from China.

TEKBUYZ COMMENTARY

We have alway said that China was going to be problem

Yes, Samsung's Gear Live Smartwatch Will Run Windows 95 (And No, It Won't Run Crysis)

Let's be honest here -- it's a relatively safe bet that Windows 95 was never on your radar when you thought about purchasing a smartwatch, which assumes you're even interested in the emerging wearable category to begin with. Android Wear, iOS, and Tizen? All viable candidates (if not now, then soon), and you might have even looked into webOS (remember webOS?). But while Windows 95 was never a consideration for the vast majority, at least one novel individual came up with the idea, and then made it happen onSamsung's Gear Live.

His name is Corbin Davenport and before you ask yourself, 'Self, why would someone go through the trouble of porting Windows 95 over to a tiny, underpowered smartwatch display?,' perhaps the better question to ask is, 'Why not!?' Granted, the usefulness of such a hack is certainly something to question, but it's all in good fun. It also underscores how far technology has advanced since Windows 95 was in the driver's seat many moons ago.

In his YouTube video, Davenport notes that he got Windows 95 to run on Android Wear using aDosBox, a free app that's available to download on Google Play. It's not ideal, but when it comes to porting Windows 95 onto Android Wear, there aren't exactly a bunch of options.

"Faster emulators like DOSBox Turbo don't seem to work properly on Android Wear," Davenport notes. "That's why it's slow."

Be that as it may, Davenport does indeed get Windows 95 successfully up and running on his Gear Live, though not without some wonky behavior. It's easy to navigate the menus and desktop in Windows 95 using touch input on the Gear Live, but if you try to run an application, it will crash due to lack of RAM. Samsung's Gear Live actually boasts 512MB of RAM, but aDosBox wasn't written for this sort of thing - bummer!

Still, it's a pretty nifty hack, and if you enjoy stuff like this, check out Davenport's other YouTube videos. He has a couple of similar videos, one of which shows Doom running on Android Wear and another with Minecraft PE running on it.

'BadUSB' Malware Now Out In The Wild, Exploits Not Far Behind

In the summer, we learned of a severe issue that plagues a countless number of USBdevices, tying into an exploit later called "BadUSB". Thanks to the efforts of Karsten Nohl, chief scientist at SR Labs, it was exposed that the firmware on many USB devices could easily be reprogrammed; the level of security on them turns out to be minimal, or non-existent. Firmware is effectively the brain of a USB device, so if it can be reprogrammed, it doesn't take much imagination to understand what could happen.

While Nohl has an exploit that demonstrates the issue, he's refused to release it to the public, citing the need to let companies fix the bug in current and future products. On account of the fact that vulnerable devices are out there in the millions, it's easy to understand his reasoning here. Still, Adam Caudill and Brandon Wilson are two researchers that don't agree. They reverse-engineered the bug, and took it upon themselves to release it to the wild. It's now available on Github.

Whether this is irresponsible of them or not, that's for you to decide. But with the exploit now out there in the wild, companies that produce USB devices need to research and understand it, and then make sure their future products don't suffer this vulnerability. But let's be realistic: Some people are going to take this exploit and do bad things with it.

At the moment, it seems this exploit mostly targets Phison-based products, but this issue is definitely not limited to those. With some usable code out in the wild, it's really hard to predict what we're going to see in the near-future. It's just a waiting game at this point.

Think Apple And Google Encryption Makes You Safe From Prying Eyes Of The NSA And Law Enforcement? Guess Again

Apple is making a big deal about its encryption scheme in iOS 8 and is championing itself as a purveyor of user privacy. The way Apple chief Tim Cook explains it, Apple wouldn't be able to help law enforcement infiltrate your iPhone even if it wanted to because the encryption is too strong. Google's been echoing a similar sentiment in regards to its forthcoming Android L release, which will turn on encryption by default. But are such mechanisms truly secure?

That depends on the context. Using encryption is certainly more secure than not using it, but when it comes to the U.S. government and its various agencies that have a penchant for spying on users, these encryption measures only slow down the process, they don't stop it

Jonathan Turley, a constitutional law professor at The George Washington University Law School, toldBloomberg that the privacy measures touted by Apple and Google "are wildly exaggerated" in part because law enforcement officials can still gather evidence by more traditional means. In addition, the NSA is capable of breaking or bypassing encryption.

"Citizens should not assume that these encryption devices will necessarily prevent government from intercepting communications,' Turley added. "If history is any guide, the government will find a way to penetrate these devices."

Beyond that, law enforcement can still use wiretaps and request call-details records. They can also force companies to hand over cloud data and intercept communications, and though it might all be encrypted, all that does is buy a little bit of time.

Russian Hackers Dump 5 Million Gmail Passwords On Bitcoin Forum

Every year it seems like hackers are breaking into websites and online services to get at everyone’s personal and credit card information. Kickstarter and Forbes were just some of the websites attacked, causing users to change their passwords. The latest occurrence revolves around five million Gmail addresses and passwords showing up on a Russian Bitcoin forum.

The Gmail addresses and passwords were procured by Russian hackers, but there is some good news. It appears that the data is old and possibly originates from multiple data breaches, claims one security firm. In addition, the data seems to have been acquired from other sites that allow users to sign in with Gmail rather than retrieving the data from Google itself.

Image credit: Google

Commenting on the recent event, a Google representative sent out a statement that reads, “The security of our users is of paramount importance to us. We have no evidence that our systems have been compromised, but whenever we become aware that an account has been compromised, we take steps to help our users securetheir accounts.”

Meanwhile, various users noticed that their accounts and passwords were in the archive but noted that the passwords taken were either old or not their Gmail password but a password used for other sites. Some of the sites, where the data was collected from, were identified that includes Friendster, FileDropper, and Freebiejeebies.

However, if a user’s password is one they reuse all the time, then it would be wise to change it. Those with unique passwords for their Gmail account appear to be safe. But if you really want to protect your personal information, then be sure to implement the two-factor authentication feature on websites and services that provide it. 

The hacker 'skills gap' may be more of a strategy gap

By Taylor Armerding, CSO |  Data Protection

Add a comment

September 03, 2014, 1:32 PM — It sure feels like the bad guys are winning.

In the ongoing cat-and-mouse game between malicious hackers and their targets any individual, company, agency or government with information that might be profitable or useful the bad news for the "mice" arrives with alarming regularity.

It is not just Target, although the breach late last fall of 40 million credit card numbers and 70 million addresses, phone numbers, and other pieces of personal information remains the biggest in U.S. retail history.

[Why Russian hackers are beating us]

It is the ongoing string of them since then: In this year alone, the more high-profile victims include UPS, P.F. Chang's, Shaw's, eBay, Adobe, Forbes, Kickstarter, Blizzard Entertainment and Dairy Queen.

More recently, Russian hackers reportedly breached JPMorgan Chase's (JPMC) network and gained access to gigabytes of data that likely came from the files of bank employees, including executives.

Even more recently, Mozilla warned about 97,000 early testers of the Bugzilla bug tracking software that their emails and encrypted passwords had been exposed for three months. That is not the first time Mozilla, whose browser Firefox is among the more popular on the market, has had a problem with leaking passwords.

And just this week came word of a "massive hack" of Apple's iCloud service, that resulted in a flood of nude images of dozens of female stars being posted on online message boards.

So it doesn't seem like there would be much to dispute about W. Hord Tipton's recentdeclaration in a post on Dark Reading that, "The bad guys are winning."

Tipton, executive director of the International Information Systems Security Certification Consortium (ISC)2 and former CIO at the U.S. Department of the Interior, said this is in large measure because the bad guys are better than the good guys that there is, a "skills gap" between hackers and defenders.

"Until the information security workforce catches up, we will continue to see the increasing success of sophisticated attacks," he wrote.

Tom Kellermann, chief cyber-security officer for Trend Micro, would appear to agree. "Russians are more intelligent than Americans," he told CSO, following the hack of JPMC.

But other security experts, while they don't disagree outright, say the situation is a bit more nuanced than that.

It starts with the definition of "winning." As has been pointed out numerous times, nobody hears about it when security measures successfully thwart attacks. It's only when security fails that there is publicity. So, attackers can fail the large majority of the time and still be "successful."

It is also easier to be on offense than defense, as Aaron Cohen, COO and cofounder of Blackfin Security, which operates the Hacker Academy, notes.

"It's a lot easier to know the play than to defend it," he said. "And there's a much bigger attack surface out there than before you always have the low-hanging fruit."

Richard Bejtlich, chief security strategist at FireEye and a nonresident senior fellow at the Brookings Institution, agrees, noting that attackers have the initiative.

"Cyberspace favors the offense," he said. "Defenders are not allowed to take the initiative to degrade adversary capabilities through direct action against the intruder's resources."

[Survey: Most hackers do it for the lulz]

Bejtlich also said that he does not see an intruder simply gaining unauthorized access as an automatic win. "If you define it a win' for an intruder to accomplish his ultimate mission stealing data, altering a system, degrading resources then it is possible for intruders to lose," he said, adding that, "preventing the consequences of unauthorized activity should be the mission for defenders."

It is also a bit more complicated than a "skills gap," they say. "I don't agree that the bad guys are always smarter," Cohen said. "I know some really smart good guys."

The problem, he said, is that it is frequently not the professional "defenders" the IT staff who fail to prevent breaches. It is workers in other departments who fall for a scam like phishing or use weak passwords, or workers from third-party contractors (as was the case with Target), who open the door to attackers.

"There is no patch for human stupidity," Cohen said.

That said, security experts do agree that defensive skills can and should be better, and that to achieve it, education in cybersecurity must improve.

It has to start, they agree, during the formative education years. "We've known for a while that we're not turning out enough cyber security professionals, starting at the K-20 level," said Michael Garvin,(senior manager, product management, Cyber Security Group at Symantec.

But he and others say that is only the beginning that to have defenders with the skills to counter the sophistication of attackers, they need hands-on, real-world experience.

"Pilots spend hundreds of hours in flight simulators before flying a real plane, gaining the skills they need and building muscle memory through repetition in a safe environment," Garvin said.

[Hackers could be fair game for deadly force, cyberwar experts say]

Bejtlich agrees. "I would not want to take security classes from a professor who lacks time defending an enterprise," he said.

That is Cohen's message as well. "High school and college is one area where we are so far behind. You can't train through a book," he said, arguing that cybersecurity training has to be more practical and hands on, somewhat like a vocational school.

He said much of the training at the Hacker Academy and other available courses is real-world simulation. "Until you're thrown into the fire, you don't know," he said.

However, if college and university infosec programs are going to improve, it will likely take some initiative and collaboration from the professionals. "The relationship between universities, colleges, careers services and the infosec community needs to be joined up," said Andrew Avenessian, vice president of professional services at Avecto.

"Organizations in the IT security space need to work with schools, universities and colleges to guide and advise them on the skills and competences needed in an ever-evolving environment."

Avenessian and others also say a computing degree is not the only path to a successful cybersecurity career. "They could be studying mathematics, engineering or management," he said.

Bejtlich agrees, but said effective defense has to go well beyond academic training and technical expertise.

"The majority of defenders don't think strategically," he said. They are technicians at heart and think in terms of tools and tactics. They rarely incorporate operations/campaigns, strategy, and policy."

That, he said, is the real gap. "Strategy is more important than the skills gap," he said. "One hundred skilled people wasting their time on strategically unimportant activity is the real problem."

That was the message from Kellermann as well. He said the Russian hackers are more intelligent, "because they think through every action they take to a point where it's incredibly strategic. They're operating at eight to 12 steps ahead on both the offensive and defensive side of the (chess) board."

It will take more than better training of the coming generation of workers, however. Experts agree that attitudes, techniques and training of all employees have to be improved within enterprises.

[Should companies hire criminal hackers?]

"One of the main barriers to defending against attacks are unwieldy and unmanageable security strategies that rely on reactive detection," Avenessian said. "Organizations need to simplify their approach and be much more proactive. Many fail to meet even the very basic security steps recommended in the SANS 'First Five' or Australian DoD's Top 4."

He said he regularly encounters IT departments that, "aren't focused on security, but rather on implementing the very latest technologies or broader IT solutions, forcing them to retrofit security post deployment. Security should never be an afterthought."

Cohen said some of that has to include teaching end users. "If you teach people better, then you're going to be more secure," he said, but added that better teaching has to include simulated attacks, to give employees an experience beyond the theoretical.

"It's an easy and cost-effective way to make your people better and get rid of low-hanging fruit," he said.

After attacks, Kenya takes 100 government websites offline

A fragmented approach to site management and quality assurance has resulted in inefficiency and security holes

By Rebecca Wanjiku, IDG News Service |  Security

Add a comment

September 08, 2014, 12:37 PM — After a month of embarrassing hacking attacks against government social media accounts and websites, the Kenya ICT Authority has taken about a hundred government sites offline for development and centralized hosting.

Previously, the ICTA's role within government was merely advisory. It was consulted on hardware, software and developer qualification issues, but was not involved in setting standards, ensuring security or quality assurance. The ICTA also did not have an inventory of government ICT implementations, and when the social media accounts were hacked, it was not clear who was the custodian of log-ins and passwords.

Since the attacks last month, however, the ICTA has been given more power to work with government agencies and help manage the sites.

"We conducted an audit of government websites and it revealed that in their present state, many of the government websites do not conform to the standards and are not secure," said Victor Kyalo, Acting CEO at the ICTA. "It has become necessary to upgrade the hosting environment, reorient the websites to approved standards and train officers on developing and maintaining the websites."

Sites are set to open later this week, according to report. However, no one in government has acknowledged that there is a shortage of personnel involved in information security, intrusion detection and cyber security. Some of the websites and servers are said to have been left in default settings, giving easy hacking opportunities to local and international hackers.

"The government needs to accept that there is insufficient qualified capacity within its ranks," said Tyrus Kamau, an independent security expert. "They need to embrace a deliberate hands-on approach by empowering those within with requisite practical skills."

Government ICT officers in the various ministries, meanwhile, have not had warm relations with the local Information security community. The ICT Authority is attempting to mend relationships by involving the community.

"There's a really frosty relationship with some government institutions when it comes to working with the Infosec community because they feel the community is exposing their incompetence," added Kamau. "However, ICTA is working with local security experts and we hope other government institutions can give necessary support."

The government has had a complicated procurement practice, where each ministry buys its own hardware, software and contracts directly with developers. In some of cases, coordination between ministries would save the government money. Corrupt practices and questionable deals, however, have gone hand-in-hand with ministries insisting on using their own suppliers. This has also led to a fragmentation of quality among government sites.

"Consequences need to be felt for the recklessness displayed within the last couple of months; how many commitments have been made and broken? If there's a recurrent cyber security breach, it simply means we have the wrong people doing the wrong jobs," Kamau said.

Kyalo said that the ICTA is done talking about what it will do to address cyber-security challenges, adding that he will first implement the strategy and the engage the community with results. The websites have been moved to the Kenya Education Network (KENET) hosting infrastructure. KENET in the ISP for all higher education institutions in the country, providing bandwidth and network support.