Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
IRS Attack Demonstrates How Breaches Beget More Breaches
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/29/2015 | 1:37:36 PM
Re: I died a little inside...
I always believe that what you have and are(biometrics) are more secure than what you know. Biometrics and owned hardware are more difficult to provide as fraudelent. What you know such as passwords and security questions are highly researchable through methods such as social engineering and analytics. "Your favorite food?" How many people like pizza? Questions can only be so complex. For the other options you would have to lose your device or have much more elaborate steps taken for biometrics. But this will definitely come at a cost, for both parties.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/29/2015 | 1:12:02 PM
Re: I died a little inside...
Yes, indeed, Sara. What comes after? There's lots of possibilities. But the challenges seem to increase exponentially.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
5/29/2015 | 9:47:53 AM
Re: Secure Computing in a Compromised Environment
@macker940 Well I certainly agree with you on this point: "SSL/TLS is not acceptable." Do you think we'll EVER get to the point that public key infrastructure or digital signatures or anything similar/equal will become a norm?
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
5/29/2015 | 9:39:14 AM
Re: I died a little inside...
@Paladium  Totally agree! We've got to move beyond the idea that a successful login = a legitimate login. The question is, what has to come after that? Is it just asking for more, more, more, more, more kinds of credentials? Is it behavior-based biometrics? Is it confirmations via SMS or email?

Thoughts?

 

 
Paladium
0%
100%
Paladium,
User Rank: Moderator
5/29/2015 | 9:02:07 AM
I died a little inside...
All I can say is WOW.  Not really unexpected from an organization that wants to control our lives through the tax code, but who can't even patch their computers in a timely manner.

"The information that was used to bypass the security screen, including Social Security numbers, dates of birth and street addresses, are all components of data that have recently been compromised in health insurance data breaches."

...

"Well, the IRS decided that if you know a person's SSN, birthday, and street address, then you must be that person."

That's when I died a little more inside.  It's hard enough to secure and protect our IT systems as it is, doing all the right things and still getting compromised.  But when you do little or nothing, like the IRS is doing, just WOW.

Someone stop the madness please...

 
macker490
100%
0%
macker490,
User Rank: Ninja
5/29/2015 | 8:49:57 AM
Secure Computing in a Compromised Environment
the means to provide reliable identification in a digital computer network environment has been available for years: PGP.

over the yars PGP has been depreciated by its detractors as "too complex"

Complex systems such as PGP can be made usable by everyone -- just like a "smart phone" -- by means of packaged technology: wrapping the technology in an easy to use human interface -- often called a "GUI" -- or GUI Dialog

Roots

On paper we sign our name with pen&ink.   and that signature is characterized by the individual signer,-- pretty hard to duplicate except by a highly skilled forger.   even so, with Notaries or witnesses -- the pen& ink signature has been reliable for years.

but in our online digital networks -- whe have -- nothing

except that PGP has been available since the '90s -- and not adopted for general use due to opposition from interests opposed to privacy and security and such

we may now have reached a tipping point where we will have to admit our error and mend our ways

the key factor needed to implement PGP authentications is explanded authentications.    Your PGP Public Key needs to be authenticated by a reliable party in order for your signatures to be recognized as valid.   Keep these words in mind:   In order for your signature to be recognized as valid.    This also requires an assurance that YOU made the signature -- not a some scamster.  This is possible with PGP because PGP provides both a Public and Private key for each user.   The private key is required to make a signature while the public key is required to recognize(authenticate) a signature.

Exactly what we need!

The only issue is in getting the Public Keys authenticated.   This should become a service offered by local Credit Unions and Banks.    After you generate your key you take it to the Credit Union.  They check your ID and then counter-sign it and upload it to the keyserver.

Now you will be able to authenticate your 1040, online banking, shopping &c

SSL/TLS is not acceptable: it is a half-baked system: The server is able to identify itself -- but not the client.  Even the server's ID is questionable as the client has only marginal trust for x.509 certificates: he or she has NOT verified and countersigned the x.509 certificates he/she needs to use.   This is what enables MITM attacks.
<<   <   Page 2 / 2


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...