FBI Investigates the Cardinals

The FBI is investigating the St Louis Cardinals for a hack of the Houston Astros.

The Cardinals reviewed a “master list of passwords” to access the Houston prospect database.   A former employee of the Cardinals now worked for Houston in setting up this system.  The FBI tracked the unauthorized login to the home of Cardinals team officials.

source – NY Times.  (if the link is paywalled, do a search on google to find the article or add a google refer to your request.)

This illustrates why password reuse is a problem.  Additionally if passwords were routinely changed, even with an admin using the same password initially,  they would be forced to change it to something else.  One does wonder about this “master list of passwords”.   I’m guessing these were service or admin account passwords rather than the organization knowing individual user passwords.  At least I hope so.

You wouldn’t grow your own electricity

I’m going through RackSpace’s free CloudU training.

They use the analogy of infrastructure a couple of times.

  It would be bizarre, given widespread availability of electricity on tap, that an organization would create their own electricity plant to power their factory, so too is it becoming more bizarre to host one’s own software or buy one’s own hardware.

It sounds great.  I suppose we shouldn’t look at it too much though.

What business of any size doesn’t have battery backups on the data center and network gear?  Who doesn’t have a generator to keep the servers running if the outage is more than a flicker?

How many data centers have the windfarm and solar panels storing energy in batteries for use later?

Its rare but people do go off grid (on homes, not data centers as far as I know).  The Telsa battery announcement may make this even more common.

Why would they choose to undertake this capital expense?

Infrastructure may free you to focus on your prime business, but it also makes you dependent.   I’m not arguing against the cloud, I just was thinking about whether their analogy is breaking apart already as battery and green technology improve.

Setting up RT-AC68P for Tunnelbroker

In the past, I had a iPad Mini through work.  It was on Verizon, and I could tether to it to get and IPv6 address when I wanted to test.    I can’t really justify the monthly data plan cost, and the upfront hardware cost to get that on my own.  So I finally set out to set up tunnelbroker from Hurricane Electric to proxy IPv6 traffic over IPv4.   This task was made easier by having a newer router/accesspoint from ASUS, the RT-AC68P.

I found a number of setup examples on the internet, the best for me was a thread on the Hurricane Electric forum.

The one issue I had following these instructions is adding tunnelbroker to dnsomatic.

The hostname should be the fqdn assigned by hurricane electric and they now use an update password (on the advanced tab) rather than the password to log into tunnelbroker.

Other than that, piece of cake.

The ASUS RT-AC68P contains an IPv6 firewall for unsolicited inbound traffic so make sure that is enabled.

 

Not a Phish this time

Last week, I needed to ask my mortgage company a question.   They responded with a Cisco Secure Mail message.  This meant I had to create a Cisco account.  Set up password reset questions.  And eventually I was able to see the message ”

Thank you for your request. We are reviewing your information and will respond as quickly as possible. If we have any questions, we will contact you.

That was a lot of security for a message that essentially says “your call is very important to us, please stay on the line and your call will be answered in the order it was received”.

Additionally, they sent a letter to my home with the same information.

Today, I received an email with subject Regarding Loan Number 325,632,897 (not the actual numbers).  There was nothing in the body of the message.  I did not recognize the sender domain.  There was a PDF attachment.

Other than Gmail allowing it to my inbox, there was every indication this was spam.

I checked out the headers and saw it passed SPF and had a dkim signature.  Turns out the domain is for a company that does technology for mortgage companies.   The file passed virustotal.  It turned out it was a reply from the mortgage company.

Kind of funny that when saying nothing at all, they make me jump through the hoops of Cisco secure mail.   But when sending an actual response it looks like phishing.

HR Recruiting should step it up to obtain top infosec talent

With infosec unemployment approaching 0%, particularly in the DC are where I live, companies need to be competitive in their recruitment.  Jeff Snyder of SecurityRecruiter.com posts an interesting article on this.

I changed jobs in 2014 and a lot of this rings true to me.

Obviously improvements in salary, telecommuting, vacation, good retirement matching and good retirement program would be a nice start.   But this is about the hiring process not fantasy. 😉

There are reasons why so many jobs go to people with connections. It’s not necessarily because networking is so awesome.
Is the job posting interesting? When you are networking, your contact can tell you what’s great about the job.  If you’re coming in cold, what about that posting sets it apart?  While I’ve seen examples that go too far in the other direction, generally going too far isn’t the problem.   Most are boiler plate for 50% of the content.

Is recruiting treating the resumes like an auditor running down a checklist?   Most job seekers believe this is the case.  They add in buzzwords to the résumé thinking they will score higher on relevance.   If the HR recruiter is looking for 3 years of X and 2 years of Y, they may miss out on a great candidate.  The best resume may never make it past the gatekeeper to the hiring manager.   Another point for networking.  It gets the résumé into the hiring manager’s hands.

According to Jeff, companies are still taking too long in making decisions.   With the short bench, talent has lots of choices.   If you’re planning to hire the people you attract to a job req, you should be ready to move.

Check out Jeff’s article  for more on this topic.

 

Chrome, Firefox Leak actual IP of VPN Users

A post on Friday, at torrentfreak.com reveals a security flaw in WebRTC enabled browsers that leaks the actual IP addresses of VPN users.

I primarily use VPNs to protect my data when on a untrusted network (such as at a hotel, coffee house or other hot spot.  It also comes in handy to check access from other parts of the world, by VPNing to a foreign point of presence.

VPNs are also used for anonymity.  Websites are able to make a STUN request, and the browser’s supporting this request will reveal what was thought to be protected IP addresses of the client.

You can check if you are affected at a test website set up by Daniel Roesler.   https://diafygi.github.io/webrtc-ips/

In my case when using Chrome, the website shows 2 internal IP addresses (wired and wireless), my VPN client IP address, my external (ISP) IP address, and the IP address my request is coming from.

Internet Explorer does not support WebRTC and does not leak this information.

Per torrentfreak, fixes in Firefox include running NoScript.  In Chrome ScriptSafe or WebRTC Block.

 

Phishing Drill

This morning I was looking at my work email in Good, and saw I had a ‘package undeliverable’ email.   Since I dont use my work email address with any deliveries I figured this was phishing.   Because the address is less than a year old, I sighed that my address was already known to spammers and scammers.   When I got to my desk, I took a look at the mail headers just to verify it had slipped past MessageLabs (Symantec.cloud), so I could submit it as a false negative.

The mail headers revealed a ‘phishme’ mail server.   This indicates it is a phishing drill rather than an actual phish. I almost want to click on the link in the message to see what the education message looks like.   Better not so I dont end up on any ‘bad’ list.   I’ve been on the other end of that, looking at the list of people who took the bait and shaking my head.