Safeguarding the web

Michał Rosiak, Senior ITN Security Specialist at Orange Polska speaks with WBJ Observer about web security and the economic and psychological implications behind attacks. Orange has been at the forefront of web security, sharing its findings and best practices with the industry in its latest Computer Emergency Response Team report

Interview by Matthew Czaja

Can you describe, in layman’s terms, the February 4th e-banking attack? What was at risk? How did Orange resolve the problem?

A popular ADSL router firmware was compromised. This allowed the cybercriminals to access the administration panel of the router from the internet. The administration panel of this particular firmware used on various routers was accessed by default from the internet and the default credentials were very simple (e.g. login:admin and password: admin) – which made the breach possible.

The perpetrators were able to change the DNS server addresses to rogue servers. DNS servers are responsible for the conversion of web addresses to IP addresses. Hence, the break-in redirected users who thought they were accessing their bank accounts to a pretender website that could then capture their e-banking user passwords and key logins when they typed them in.

Clients of three Polish banks were affected by this malicious attack. At least a few people lost from several hundred to several tens of thousands złotys. We found that the vulnerability is being exploited within our network at about 10:00 or 11:00 pm. We immediately decided to shut down the links to the rogue DNS servers, which might have looked like a network outage for the users.

The next day we “sinkholed” the DNS servers, which, unlike “blackholing,” redirects the users to the correct servers while still blocking the rogue sites. The next day, several of our network users received a message about the breach and were instructed to fix their routers accordingly.

[caption id="attachment_85856" align="alignleft" width="300"] Image: Orange Polska[/caption]

How can a short disconnection from the internet influence a company?

Nowadays, our offline life and our online life is hard to distinguish from one another. When you look at a company like Orange, a 15-minute system outage could obviously result in an avalanche of data, messages and social networking traffic backlog; not to mention very negative publicity for the company.

Imagine a bank website. When their website is down for even 10 minutes, the company is in deep trouble. Such a small window might be just the moment when a customer needs to make a payment, book a flight, etc.

Bank account or e-banking password security breaches seem to be the most dramatic – because there is a perceived direct risk to assets. Is it really so dramatic? Can you help us identify other common risks that are bound to worry companies and individuals?

When I think about cyber-attack-related risks, I remind myself of the attack on the network of Target, the second biggest retail store company in the United States. It started from a breach directed at a company that services air conditioning for Target stores. The cybercriminals managed to get credentials for Target's VPN connection and then to reach the network which distributes software to the Point of Sale registers, which – to my utmost shock – wasn’t physically separated from the company’s main network! They planted a malware on the POS registers, which dumped the memory of the cash register at the very moment when the credit card is being decrypted for the transaction. As a matter of fact, they stole 40 million credit card numbers with CVV codes plus 70 million reads of individual data including email addresses, post addresses and so on.

Considering increasing volumes of big data, personal (or company) data protection becomes an even deeper issue. What challenges do you foresee for database managers?

Definitely, the risk increases with increased data. The more data you have, the more storage you need. It is easier for bigger companies like Orange to protect their data, whereas smaller companies have to rely more heavily on the security procedures and IT safeguards they have in place.

At Orange, when we send sensitive data we are required to encrypt the emails using our public key encryption, therefore even if it falls into the wrong hands it cannot be decrypted. When the company is big, you have to put in place DLP solutions (Data Leak Prevention). It senses when data with certain characteristics is being sent outside the network or is being recorded on a pendrive. Consequently, the data transfer can be stopped before it leaks out.

Do you think that outsourcing of services can become a security challenge?

If the security is taken care of in a right way, it might be just a marginal issue.

Although, the most important solution here is accountability inside the company as well as outside of it.

[caption id="attachment_85854" align="alignright" width="300"] Image: Orange Polska[/caption]

First of all, there is no chance that just anybody can enter our network – we require a contract with our partners that specifies all access rules: what is allowed, what is disallowed, and so on. If a company has access from its own office, then the access is through a specific connection, from a specific IP address, to a specific IP address that has been previously agreed upon. And there must be total accountability. Meaning that we must know who and when logged into our network. So if something happens, we can track back and find the responsible parties.

Spam lowers the efficiency of electronic mail as a service. Is there an initiative to limit the output of spam, in other words, the source of the problem? At what stage is this anti-spam initiative in Poland?

You are a bit late. Around five years ago, Poland was going through an important time for fighting spam. Telekomunikacja Polska (today Orange Polska) deployed the port 25 blockade. Port 25 is used for communication between mail servers and is also utilized by client software for communication. The problem is that port 25 is unencrypted, and it is very easy to fake when you have malware on your workstation. The malware can fake that your computer is a mail server and can send large chunks of spam email to other servers.

It was very difficult for us to implement this, as this might have necessitated changes for internet mail providers. We changed the ports from 25 to port 587 or port 475 – communication via those ports can be encrypted and the malware cannot mock a mail server. When we implemented the port 25 blockade, spam generated from Polish IP addresses dropped by 99 percent! Until that time, Poland and Telekomunikacja Polska were among the top generators of spam in the world.

In addition, I should emphasize phishing as a risk. Phishing is something that derived from spam. It is called phishing because cybercriminals are “fishing” for victims and taking advantage of you when you let your guard down. Its goal is to take sensitive information from you or make you click a link that may infect your system with malware. It is very tricky, because the messages are crafted, unlike spam, to be very believable, legit emails. It may even pretend to be your bank or business partner. Spear phishing is very dangerous – it relies on personal data from social networking sites to even trick the user into befriending the cybercriminal, basing communication on the real interests of the victim. The probability of a victim being tricked into clicking on a link is very high in a spear phishing attack.

There are keyloggers, trojans, rootkits and other security concerns – how do you stay on top of the game and remain privy on all the new risks that pop up?

[caption id="attachment_85853" align="alignleft" width="300"] Image: Orange Polska[/caption]

We have our Security Operations Center, which monitors our network of more than 20,000 workstations as well as crucial business systems. We also cooperate with other providers, as the issue of security is equally important to all entities on the market. When something goes wrong, it is not good to hide it. The February 4th attack is one such example. If an attack occurs in Asia and the communication channels are fast enough, we can proactively prepare for the attack and get ready for the specific pattern of network traffic and thus avoid the risk.

Our experts are true fans of web security. When most people relax after work, these guys are sharing news on the latest bugs, deciphering new risks and so on. We also stay on top of the web security scene by taking part in a lot of conferences, incl.the PLNOG (Polish Network Operators' Group) conference, Safer Internet, and so on, basically all such meetings connected with cyber-security.

In addition, in February 2015, we issued the CERT Orange Polska Report in which we summarized the most important cyber-security threats from the previous year as well as trends and challenges for 2015.

How is social engineering used to compromise company security?

It is the pilar of cyberattacks. Cybercriminals gain people's trust in a way where they don't have to coerce anyone to do anything against their will. The victim may be totally unaware that their security is being compromised. Through manipulation and mind games, we engage happily in activity that unknowingly may prove to be very harmful to ourselves.

A non-technical question: can a company’s transparency and public outreach policy prevent attacks by hackers?

If a company is arrogant and overly confident, saying “hackers don't stand a chance against our systems,” their bound to be targeted. Bad guys like such challenges. On the other hand, a number of companies have initiated a crowdsourcing type of cyber-security competition called “bug bounty.” It is a clever initiative that rewards programmers, hackers and people that have the skill to compromise a company's security, by offering them monetary reward for highlighting potential security breaches and keeping them secret. The way it works, is that a company announces a competition saying, “try us, show us where we have potential holes in our security systems.” Such an incentive can be – and quite often is – a significant source of income for individuals. Real security breaches are thus safely under control and hackers are helping the company make its network more watertight. At the same time, bug bounty dissuades potential offenders from targeting that company.