Connect with us

Cyber Security

Zero-Factor Authentication: Owning Our Data

Avatar

Published

on

Are you asking the right questions to determine how well your vendors will protect your data? Probably not.

Let’s say you own a small business, and you want to get a payroll service to help with withholding taxes and automatic deposits into your employees’ accounts. That’s a very useful, powerful service: You’re giving a third party the right to withdraw funds from your bank account and send them to others. 

Being switched on to security, you’d look for a payroll company that supports multifactor authentication (MFA) based on a time-based one-time password (TOTP) application, knowing that SMS-based two-step login is effectively (in the words of Allison Nixon and Mark D. Rasch at Unit 221B Research) zero-factor authentication.

The trouble is, as of about three weeks ago, none of the major online payroll companies offered this feature. If you ask those companies, they’ll say they offer SMS-based two-step login and then assure you they take security seriously. 

I found one firm that does support application-based MFA: I’ll call it Payroll Company B. PCB isn’t a payroll company as much as a professional employer organization, but still, it does payroll — for twice the price of the others I just mentioned. 

Anyway, you sign up. And after you go through the rigamarole to get the TOTP application working, if you’re attentive, you may discover a seedy backdoor: If you were to forget the Web front end,call PCB’s toll-free support number, and tell the company you need to make an account change, the entire authentication regime falls apart with these dreaded words:

“For security purposes, please tell me your full name and the last four digits of your Social Security number.”

Yes, it verifies your identity by asking you for public information. Once provided, no further authentication is required, and you can request a password change, or the removal of TOTP-based MFA, or, presumably, to send Bob’s paycheck to Alice. You’re in.

And you’re root because it has verified your identity. After all, who else could possibly know your full name and last four digits of your Social Security number?  

Who indeed?

Without installing, for example, a proper and secure multifactor, telephone-voice-based authenticator capability, these companies are left to improvise methods to hack together a security story to offer to security-conscious customers. After I discovered its glaring password reset vulnerability, I spoke with a helpful PCB supervisor and asked him to disable phone support. He cheerfully (and genuinely) promised to do so, saying he put a note in my account. I waited two weeks, phoned back, authenticated with a different rep using just my name and last four digits of my SSN, then asked the rep to close my account. In the company’s failure to fix the problem, it made liars out of dedicated and creative support staff.

Forget Password Policy. What’s Your Password Reset Policy? 
This vulnerability is so mind-thwackingly obvious that I cannot believe I need to say this, but it also raises an important issue that is relatively unaddressed by my colleagues in the financial services world: When we do vendor onboarding and qualify the vendor’s security policies, are we asking the right questions? 

Or are we sending them a 120-question spreadsheet containing lots of questions about firewall rules and antivirus? As a friend who is a very high-ranking financial services security leader said to me the other day, “Oh, that doesn’t happen. I’ve never sent a spreadsheet like that in the last week … “

This is not a theoretical issue. Recently, there was an attack that worked like this: The attackers had an in at a national mobile carrier and SIM-swapped the phones of some people in a targeted industry. They then used the pirated mobile numbers to call a firm that specializes in outsourced services to that industry, claimed to be the SIM-swapped employees, and requested — verbally —  password resets. That worked, as it would have worked at PCB.

This was an attack against a third party that for many firms would have bypassed entirely the security monitoring they have in place to defend their assets. The phone was swapped at the carrier, and the password reset was done at a third party, which also set up the fraudulent transactions when the crooks logged in to that service. The firms that didn’t fall victim to this last phase were those that did transaction anomaly detection fast enough to understand the transaction was weird. 

Would your firm have caught it? More importantly, would your vendor procurement process and onboarding have asked the question, “Do you allow password resets via voice call?” 

Many companies don’t ask the question. I spoke with colleagues at household names in the financial services space, and many firms are struggling to catch up.

What is clear is that we are all trusting cloud-based companies more often, if not exclusively, to handle those parts of the business we seek to outsource. Looking at the standard questionnaires, I see a lot of question-types missing. 

For example, rather than asking lots of questions about endpoint antivirus or whether the vendor’s facility is in a location with little to no risk of natural disaster, terrorism, or civil unrest, it might be good to ask whether the vendor has separate production and nonproduction environments, or how their admins and developers access the environments, or how customer password resets are done.

In other words, we need to ask questions designed to understand the ways someone could subvert the vendor’s authentication and access control regime. 

I’ll be speaking about some of these things at the RSA Conference 2020 in San Francisco on February 26. I hope you will leave comments here and chat with me there. 

Related Content:

Nick Selby is the Chief Security Officer for Paxos Trust Company, which creates contemporary infrastructure to support global institutional financial transaction settlement. Prior to Paxos, Nick served as Director of Cyber Intelligence and Investigations … View Full Bio

More Insights

Source: https://www.darkreading.com/attacks-breaches/zero-factor-authentication-owning-our-data/a/d-id/1337068?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cyber Security

Threat Intelligence Case Study: A SIEM of SIEMs

Avatar

Published

on

States across Australia are creating SOCs through integration with industry. Each organization is feeding actionable SIEM information through to those central SOCs so that they can then benefit from “… Checkout PrimeXBT
Source: https://www.cshub.com/executive-decisions/articles/threat-intelligence-case-study-a-siem-of-siems

Continue Reading

Cyber Security

ProAct Safety to Discuss Common Problems with Safety Strategy at…

Avatar

Published

on

Shawn Galloway has been selected to present a technical session at NSC Congress, the world’s largest annual event for safety, health and environmental professionals.

(PRWeb March 02, 2021)

Read the full story at https://www.prweb.com/releases/proact_safety_to_discuss_common_problems_with_safety_strategy_at_national_safety_council_congress/prweb17761441.htm

Source: https://www.prweb.com/releases/proact_safety_to_discuss_common_problems_with_safety_strategy_at_national_safety_council_congress/prweb17761441.htm

Continue Reading

Cyber Security

Passwords, Private Posts Exposed in Hack of Gab Social Network

Avatar

Published

on

The Distributed Denial of Secrets group claim they have received more than 70 gigabytes of data exfiltrated from social media platform Gab. Source: https://threatpost.com/hacktivists-gab-posts-passwords/164360/

Continue Reading

Cyber Security

Firewall Vendor Patches Critical Auth Bypass Flaw

Avatar

Published

on

Cybersecurity firm Genua fixes a critical flaw in its GenuGate High Resistance Firewall, allowing attackers to log in as root users. Source: https://threatpost.com/firewall-critical-security-flaw/164347/

Continue Reading
Blockchain42 mins ago

Bitcoin Projected to Rise Above $100,000 by 2022: Magnetic MG

Blockchain1 hour ago

Meerkat Finance drained of almost $32M after launch on Binance Smart Chain

Blockchain1 hour ago

Rock Band, Kings of Leon Set To release Eighth Album As An NFT

Blockchain1 hour ago

EOS, Crypto.com Coin, Dash Price Analysis: 04 March

Blockchain1 hour ago

Announcing TGE: Taraxa Wants to Put Every Informal Transaction on the Record, Unveils Details About the Upcoming Public Sale

Blockchain2 hours ago

California Rep. Ro Khanna bats for ‘cannot be devalued’ Bitcoin

Blockchain2 hours ago

Kraken CEO Steadfast on Bitcoin ‘Going to Infinity’

Blockchain2 hours ago

Dogecoin price no longer reacting to Elon Musk’s tweets

Blockchain2 hours ago

Tim Draper believes Netflix could be next to invest in Bitcoin

Blockchain2 hours ago

TomoChain (TOMO) Increases after Retesting Previous All-Time High

Blockchain2 hours ago

Bitcoin whales are stockpiling BTC around $48k: CryptoQuant

Blockchain2 hours ago

Tron Dapps Market Gets A Boost As Bridge Oracle All Set to Launch MainNet Soon

Blockchain2 hours ago

Ripple Price: XRP poised near key supply barrier at $0.50

Blockchain3 hours ago

Binance coin price analysis: BNB bulls seek fresh impetus above $240

Blockchain3 hours ago

Giottus technologies offers access to Bitfinex liquidity

Blockchain3 hours ago

BSC Project Meerkat Finance Allegedly Rug Pulls Nearly $32 Million in BUSD & BNB

Blockchain3 hours ago

Cardano Price Analysis: 04 March

Blockchain3 hours ago

More Rate Shocks for Bitcoin Ahead Despite Latest Price Rebound

Blockchain3 hours ago

Ripple CEO Files Dismissal Motion on SEC Charges

Blockchain4 hours ago

NFT News: Rock Band Kings of Leon Plans to Release New Album As An NFT

Blockchain4 hours ago

Ripple CEO files a motion to dismiss the SEC’s complaint against him, calling it “regulatory overreach.”

Blockchain4 hours ago

Banksy Art Piece Set Ablaze and Replaced with NFT

Blockchain4 hours ago

Masterchain and Massive Exploration: Blockchain Tech is Gaining Traction in Russia

Blockchain4 hours ago

Enjin Unveils Plans to Become a Multi-chain Ecosystem for NFTS

Blockchain4 hours ago

Elrond & Reef Finance Team Up for Greater Connectivity & Liquidity

Blockchain4 hours ago

Kentucky Offers Tax Exemption to Attract Crypto Miners

Blockchain4 hours ago

Cook Protocol: Decentralized Asset Management Platform

Blockchain4 hours ago

Apple Pay Users Can Now Buy COTI Via Simplex

Blockchain5 hours ago

Bitcoin SV, Uniswap, Zcash Price Analysis: 04 March

Blockchain5 hours ago

Bitcoin (BTC) Rejected After Sprint Past $50,000

Trending