Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/4/2016
10:30 AM
Kevin Bocek
Kevin Bocek
Commentary
Connect Directly
Twitter
Google+
LinkedIn
RSS
E-Mail vvv
50%
50%

2015: The Year Of 'Attacks on Trust'

Nine attacks that leveraged stolen, compromised, or unprotected cryptographic keys and digital certificates show how easy it is for cybercriminals to bypass security controls and hide their actions.

Looking back over 2015, Venafi Labs captured data on a steady stream of cyberattacks involving the misuse of keys and certificates which threaten the underlying foundation of trust for everything that is IP-based. These “attacks on trust,” as we call them, also show how keys and certificates have become interwoven into many aspects of our business and personal lives. From airline Internet services to laptop software to government certificate authorities (CAs) to apps for your car or your fridge to Google and banking sites, keys and certificates secure all our online transactions.  

Why is this important? If organizations cannot safeguard the use of keys and certificates for communication, authentication, and authorization, the resulting loss of trust will cost them their customers and potentially their business

Here is a sample of nine notable security incidents the Venafi Labs threat research team followed:

1.    Gogo dished up Man-in-the-Middle (MITM) attacks

To kick off the year, a Google Chrome engineer discovered that the Gogo Inflight Internet service was issuing fake Google certificates. Gogo claimed it was trying to prevent online video streaming, but this practice ultimately exposed Gogo users to MITM attacks.

2.    Lenovo pre-installed Superfish malware on laptops

Lenovo found that an adware program it was pre-installing on laptops was making itself an unrestricted root certificate authority which allowed for MITM attacks on standard consumer PCs.

3.    CNNIC banned by Google and Mozilla

Google found unauthorized digital certificates for several of its domains issued by CNNIC, China’s main government-run CA, making CNNIC certificates untrustworthy and vulnerable to attack. Google, quickly followed by Mozilla, blocked all CNNIC authorized domains. In a 2015 Black Hat survey, Venafi found that while IT security professionals understand the risks associated with untrusted certificates, such as those issued by CNNIC, they do nothing to prevent them.

4.    St. Louis Federal Reserve Bank breached

The US bank discovered that hackers had compromised its domain name register. This allowed the hackers to successfully redirect users of the bank's online research services to fake websites set up by the hackers.

5.    New SSL/TLS vulnerability logjam exposed crypto weaknesses

Logjam exposed a problem with the Diffie-Hellman key exchange algorithm, which allows protocols such as HTTPS, SSH, IPsec, and others to negotiate a shared key and create a secure connection. Identified by university researchers, the Logjam flaw allowed MITM attacks by downgrading vulnerable TLS connections.

6.    GM’s OnStar and other car apps hacked

A GM OnStar system hack that locks, unlocks, starts, and stops GM cars was made possible because the GM application did not properly validate security certificates. By planting a cheap, homemade WiFi hotspot device somewhere on the car’s body to capture commands sent from the user’s smartphone to the car, hackers could break into the car’s vulnerable system, take full control, and behave as the driver indefinitely. Similar weaknesses allowed hacks in iOS applications for BMW, Mercedes, and Chrysler.

7.    Major CAs issued compromised certificates for fake phishing websites

Netcraft recently issued new research that found fake banking websites using domain-validated SSL certificates issued by Symantec, Comodo, and GoDaddy.

8.    Samsung’s smart fridge hackable through Gmail

A security flaw found in Samsung’s IoT smart refrigerators allowed hackers to compromise Gmail credentials using MITM attacks because the fridge was not set up to validate SSL certificates.

9.    Symantec fired employees for issuing HTTPS certificates for fake Google sites

Several Symantec employees were fired for issuing unauthorized certificates that made it possible to fake HTTPS Google sites. The certificates were found by Google’s Certificate Transparency project.

This list of attacks that leveraged stolen, compromised, and/or unprotected cryptographic keys and digital certificates in 2015 highlights a wide range of potential impacts from attacks on trust, but is by no means a comprehensive list. In truth, many of these attacks go on undetected: cybercriminals use keys and certificates to bypass security controls and hide their actions.

Businesses need to understand that key and certificate management is not just an operations issue; it is critical to securing their networks, data, and trust relationships with customers and partners. The problem is compounded by the fact that most Global 5000 organizations blindly trust the keys and certificates deployed on their networks and use security controls designed to trust these encryption components.

There is an evil force out there in the cyber realm, lurking in the shadows that no one sees until it’s too late. Without the ability to tell friend vs. foe, good vs. bad in the digital realm, our global economy is in a perilous situation -- and this is a problem that’s not going to just disappear. Looking ahead into the New Year and beyond, we’ll only see the misuse of keys and certificates occur more and more, continuing to impact online trust across the globe. 

Kevin Bocek is Vice President of Security Strategy and Threat Intelligence at cyber security firm Venafi. He is responsible for Venafi's product positioning, go-to-market strategy, and sales enablement. He brings more than 15 years of experience in encryption and key ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
audrey-privateblog
50%
50%
audrey-privateblog,
User Rank: Apprentice
2/28/2016 | 4:48:27 AM
incredible
am going to have a look at my fridge... ^^
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...