Yahoo! Japan breach possibly leaks 22 million user IDs

Attackers recently broke into systems at Yahoo! Japan and may have accessed some 22 million user IDs (representing 10% of all Yahoo! users). While the internet giant didn’t disclose how attackers got in – and stressed that no other personal information could have been accessed – this still represents a threat to users, who may receive spam messages containing malware or links to malicious websites.

Here’s what a few security experts had to say:

“Many people use the same passwords for work as they do for personal websites,” Eric Chiu, president & founder of HyTrust (http://hytrust.com/), the cloud control company pointed out. “If an attacker is able to gather these account passwords through phishing emails, it can lead to compromises of corporate networks in order to siphon data.”

So be alert. Attackers will try to get you to provide passwords and there are many ways they can do this. For example, a phishing email can trick you into providing it by making you think you’re entering for a valid purpose by a trusted organization. Also, once you or your PC has been compromised, attackers can gain access to your company’s network and do much worse damage.

Chiu also warns organizations about security monitoring tools, saying, “Unfortunately, most security monitoring solutions today are incapable of detecting good insider activity from bad. And, as organizations move critical infrastructure and applications to the cloud, the risk of attackers posing as insiders to gain access is compounded, since cloud and/or virtualized data can be copied, deleted, and/or moved from anywhere on the globe virtually undetected.”

Security organizations should look at Role-Based Monitoring (RBM) as a much more effective approach and, Chiu says, the industry’s future direction.

Chiu warns that attackers can also potentially destroy an entire corporate datacenter in a matter of minutes. These risks highlight the need for companies to secure access with technologies and processes that can detect and prevent bad actions in real-time, he said.

Nathaniel Couper-Noles, senior security consultant at Neohapsis (http://neohapsis.com/), a security and risk management consulting company specializing in mobile and cloud security services, said: “The information possibly leaked [in the Yahoo! Japan breach] can be useful to attackers indirectly, for example by facilitating further attacks such as social engineering or password guessing.”

So again, be wary when receiving email messages from people you don’t know, and even those you DO know when messages look suspicious. To avoid becoming victim of an attacker, don’t click any links, provide any information, or even respond, and further, don’t even open or read these message in a “preview pane.”

Feel free to add your guidance to ours by commenting, and stay safe online!

DDoS: Not just for taking down websites anymore

We all know about DDoS attack being used to temporarily take down targeted websites. But Jordan Robertson at Bloomberg reports that attackers are now using them as a distraction – a means to attack the victim company while their defenses are down in order to steal money, data, and cause other damage. “They’ve become the online equivalent of a common street hustle, with the initial assault being the shiny object that distracts bank security teams long enough to pick customers’ pockets,” the article reads.

Robertson recounts how attackers nabbed tens of millions of dollars from banks over the last year. And what’s worse – the affected banks didn’t learn of the intrusions until getting word from customers and investigators. Sadly, this is all too common: the most recent Data Breach Investigations Report from Verizon shows that the majority of breaches, 69 percent, are detected by third parties.

Something needs to change to enable companies to catch these breaches themselves, and much quicker. One expert calls for a change in monitoring, leading with role-based technology to catch threats in real-time. Read more on that in our previous post, Infographic: The Future of Security Monitoring.

Infographic: The Future of Security Monitoring

Twitter, Apple, Facebook, and Microsoft are all household corporate brands, and they have something in common: They have all suffered data breaches.

As attacks make headlines daily, industry influencers seem to all be calling for security monitoring and forensics tools as the “end all, be all” for solving these types of issues and preventing future incidents. But sadly, monitoring tools like SIEMs catch maybe 50% of threats, best case scenario. Gartner says 85% of organizations are failing at early breach detection. Even the recent Verizon Data Breach Investigations Report found 66% of breaches are taking months or longer to be detected. HyTrust agrees, and has found the same or similar numbers in informal polling. In fact, Eric Chiu, president and founder of HyTrust (http://hytrust.com/), the cloud control company, says “Security monitoring tools such as SIEMs are broken — they’re slow, reactive and weak.”

It’s obvious a new approach is sorely needed. Chiu says Role-Based Monitoring (RBM) is the future of security monitoring, and shared the below infographic. Based on pre-defined user roles, RBM can detect and block threats in real-time. It alerts you when something outside the norm happens. For example, an attacker using an advanced persistent threat (APT) technique might hijack someone’s corporate “privilege” – in other words, their advantages, benefits, entitlements or rights based upon their role within the organization – in order to carry out their breach more effectively.

“RBM is the fastest, strongest and most certain method of identifying threats with 98% accuracy,” Chiu said. “It provides a deeper examination of the context, looking at what was done as well as who executed the action, what their job is, and what resources they’re allowed to manage.” This enables organizations to zero-in and separate appropriate administrative operations from malicious ones, Chiu explained.

RBM is useful especially in cloud environments where ‘super admins’ have ‘super access’ to everything, i.e. they can copy, if they wish, every virtual machine with sensitive data, or tamper with controls and potentially destroy the entire virtual datacenter.

“It’s time to rethink security in-line with emerging technologies and change the way we do business,” said Chiu.