The state of being free from danger or threat. [1]
A flaw or weakness in system security procedures, design, implementation, or internal controls that could […] result in a security breach or a violation of the system's security policy [2]
A piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized) [3]
A zero day vulnerability refers to a hole in software that is unknown to the vendor.
This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it—this exploit is called a zero day attack. [...]
The term “zero day” refers to the unknown nature of the hole to those outside of the hackers, specifically, the developers. Once the vulnerability becomes known, a race begins for the developer, who must protect users. [4]
- Identify and describe possible Attackers and their motivation
- Rate the danger posed by each attacker type (:skull: to :skull::skull::skull:)
- Estimate the risk of your own employer being targeted by each identified attacker type (in %)
- Which attacker types are likely to work together and how does this impact their danger rating?
- Attacker must succeed once
- Defender must get it right all the time
- Attacker can choose the weakest spot
- Defender must defend all places
- Attacker can leverage zero-days
- Defender can only defend against known attacks
- Attacker can play dirty
- Defender needs to play by the rules
The hotel chain asked guests checking in for a treasure trove of personal information: credit cards, addresses and sometimes passport numbers. On Friday, consumers learned the risk. Marriott International revealed that hackers had breached its Starwood reservation system and had stolen the personal data of up to 500 million guests. [5]
[...] Starwood’s data has not popped up on the so-called dark web, according to Recorded Future, a cybersecurity firm, and Coalition, a cyber insurance provider, which suggested that the hotel attackers weren’t looking to sell what they took.
“Usually when stolen data doesn’t appear, it’s a state actor collecting it for intelligence purposes,” [...] information could be fed, for example, into an analysis program run by a country’s state security apparatus [...]. Using “big data” technology similar to what marketers use in targeted advertising, the country could try to pinpoint the comings and going of intelligence agents from other nations. Did they stay, for example, in the same hotel as a potential source for that country? [5]
The intrusion went unnoticed for four years by Starwood. 📆
If you have a credit report, there’s a good chance that you’re one of the 143 million American consumers whose sensitive personal information was exposed in a data breach at Equifax, one of the nation’s three major credit reporting agencies. [6]
Here are the facts, according to Equifax. The breach lasted from mid-May through July. The hackers accessed people’s names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. They also stole credit card numbers for about 209,000 people and dispute documents with personal identifying information for about 182,000 people. And they grabbed personal information of people in the UK and Canada too. [6]
Recommended steps for protection include "monitor your existing credit card and bank accounts closely" but also "consider placing a credit freeze" 🍦 or "placing a fraud alert on your files".
[...] When it comes to our identities being leaked all over the place, it’s just another day on the web. Unless it’s our children’s identities, that’s a whole new level. When it’s hundreds of thousands of children including their names, genders and birthdates, that’s off the charts. [7]
When it includes their parents as well – along with their home address – and you can link the two and emphatically say “Here is 9 year old Mary, I know where she lives and I have other personally identifiable information about her parents (including their password and security question)”, I start to run out of superlatives to even describe how bad that is. [7]
It later came out that head shots 📷 of kids and private chat messages were also exposed. The total number of children exposed in the incident is over 6.3 million.
[...] There were a lot of news headlines about how Germany had banned an internet-connected doll called "Cayla" over fears hackers could target children.
[...] Just before that, we had the VTech data breach which exposed a huge amount of very personal information.
Which brings us to CloudPets [...] which is a toy that represents the nexus of both the problems discussed above. [8]
[...] Put yourself in the shoes of the average parent, that is one who's technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works. They don't necessarily realise that every one of those recordings – those intimate, heartfelt, extremely personal recordings – between a parent and their child is stored as an audio file on the web. They certainly wouldn't realise that in CloudPets' case, that data was stored in a MongoDB that was in a publicly facing network segment without any authentication required and had been indexed by Shodan (a popular search engine for finding connected things). [8]
Impacted parents were never notified by CloudPets. 😱
- Visit https://haveibeenpwned.com/
- Type in your email address
- Hit the
pwned?button - How many pwnages do you get for your private and/or business email? (:pushpin:)
- Mark potentially malicious items in the Press Kit from the Trump-Kim Summit (2018) in the image on the next slide (:arrow_right:)
- Explain possible ways how these items might actually be malicious
- Reason about potential attackers behind this and explain their most likely motivations
- Come up with a least two more additions to the Press Kit and explain how they could be used maliciously
ℹ️ Speculation is allowed, but still be as specific as possible!
Footnotes
-
http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf ↩
-
https://web.archive.org/web/20170704035927/http://www.pctools.com/security-news/zero-day-vulnerability/ ↩
-
https://www.nytimes.com/2018/11/30/business/marriott-data-breach.html ↩ ↩2
-
https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do ↩ ↩2
-
https://www.troyhunt.com/when-children-are-breached-inside ↩ ↩2
-
https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages ↩ ↩2