The Security Ledger with Paul F. Roberts

Recent Posts

Third Party Vendor Source of Breach at Home Depot

November 7, 2014 Paul Roberts

Add Home Depot to the list of companies who have been victimized as a result of a third party contractor or supplier. The home improvement giant said in a statement on Thursday that the criminals that attacked the company’s network first gained access to the “perimeter” of Home Depot’s network. Target, the box store retailer, sketched out a similar scenario to describe the breach that resulted in the theft of 70 million credit cards numbers from its customers. In that case, a company that serviced HVAC systems in Target’s headquarters was reported as the source of the breach. Home Depot said that attackers were able to move within its network by elevating their level of network access and install what Home Depot described as “unique, custom-built malware” on self-checkout systems in the U.S. and Canada. The revelations about the circumstances of the breach came on a day when Home Depot […]

Supply Chain Risk Escapes Notice At Many Firms

November 6, 2014 Paul Roberts

Online attacks that come by way of suppliers and other third party business partners are one of the biggest threats that modern organizations face. But too few firms are giving supply chain security the attention it deserves, a panel of legal and information security experts told attendees at a cyber security forum in Boston on Wednesday. Companies need to protect their exposure through third parties better, according to the panel: beefing up auditing of internal- and partner assets and including contractual protections that will indemnify them in the event that a breach at a supplier or business partner exposes data that materially affects their firm. The panel, “Fortifying the Supply Chain,” was part of a day long event at The Federal Reserve in Boston and sponsored by the Advanced Cyber Security Center, a technology industry consortium. It brought together top legal and information security experts, including FireEye researcher Alex Lanstein and Jim Halpert, the […]

Metadata Matters: EFF To Argue Collection Violates Constitution

November 4, 2014 Paul Roberts

Lawyers from The Electronic Frontier Foundation will argue on Tuesday that the U.S. government’s bulk collection of phone records and other “metadata” is a violation of the Constitution’s protection against unlawful searches. In a blog post on Monday, EFF said that it plans to make oral arguments before the D.C. Circuit Court of Appeals on Tuesday and will argue that the call records collected by the government constitute “intimate portraits of the lives of millions of Americans” that are protected under the Constitution’s Fourth Amendment. The EFF is presenting in the Klayman vs. Obama, a 2013 case filed by Larry Klayman, conservative activist, in the immediate aftermath of the publication of data leaked by former NSA contractor Edward Snowden. EFF and the ACLU filed an amicus brief in that case in August. The government’s argument is that the bulk collection of phone records is legal under a precedent called “third party doctrine,” which […]

Study Reveals (Sad) Psychology of Facebook Scam Victims

November 4, 2014 Paul Roberts

Bad is good enough, according to a study of over 850,000 Facebook scams by the antivirus software provider Bitdefender. (PDF version of the report is here.) The two-year study of Facebook scams in the UK, the US and Europe found that a short list of lame, repackaged tricks are a well that never runs dry: fooling Facebook users by playing on their curiosity, vanity or naiveté. Almost half of social media e-threats prey on users’ curiosity. Far and away the top category of scam on Facebook are ‘profile view’ scams that offer Facebook users the ability to see who has viewed their profile. That ruse accounted for 45% of all scams on the 1 billion strong social network. The scam has been linked to malicious software downloads – often in the form of browser ‘plug-ins’ that promise to reveal Facebook profile views. It works well because it plays on Facebook users curiosity […]

Customer Support A Weak Link In Two Factor | Ars Technica

November 4, 2014 Paul Roberts

Ars Technica has an interesting write-up on an apparently successful compromise of Google’s two-factor authentication technology. Though in this case, the culprit wasn’t any system Google deployed or managed, but a gullible customer support representative working for the victim’s cell phone carrier. According to this post over at Facebook-for-hipsters site Ello.co, Grant Blakeman woke up on a recent Saturday morning to find that his Google account had been hijacked – despite the fact that he used Google’s two-factor authentication to protect access to the account. How? Blakeman enlisted the help of none-other than Mat Honan, whose own struggles with account hijacking became the subject of a much-cited Wired feature article. As with Honan, Blakeman’s valuable three-character Instagram account, @gb, appears to have been the lure for hackers. (Honan’s @mat Twitter account was what lured his attackers.) Read “Researchers sidestep Paypal Two-Factor Authentication.” After a conversation with Honan, Blakeman contacted his cell provider and […]