6 steps to protect yourself from the Yahoo email breach!

Last Thursday (09'22'16), Yahoo admitted to the largest email provider breach in history. The breach, which happened in 2014,  consisted of the account information of at least 500 million users and included names, email addresses, encrypted password and even security questions.   

 According to reports, as many as 2.1 million Rogers Communications customers could be affected, as Rogers uses Yahoo as their underlying email provider.

 

Even though the breach itself happened in 2014, We urge you to take the time to protect yourself from this event.  Since 2013, 360million MySpace accounts, 167 million LinkedIn accounts, And 145 million eBayaccounts have also been compromised.  

Human nature has us using the same or similar passwords across all of our various online sites, whether they be social media, retail, email, or banking.  Much as this is convenient, it opens us up to fraud and theft by these hackers. 

 

Take these six simple steps to protect yourself now:

 Change your online passwords now! 

• Remember that length and complexity are the easiest protection.  Use at least 8 characters, and mix numbers and letters.

Use different passwords for your banking, email, and social media sites.

• Hackers use automated tools to see if your stolen credentials work in thousands of other sites.

Enable 2-step verification.

• Most online email, banking, and social media sites provide 2-step verification.  Ie: when you log onto a new device or from a new location, they will send you an SMS text message with a validation code before you can enter.  This protects you from having others logging in pretending to be you.

Enable transaction notification on your banking!

• Online Banking sites have the option of sending you a text or email every time a transaction passes through your account. Turn this on!

Beware phishing attacks related to this breach.

• Do not respond to, click on, or open emails and attachments that say they are going to help you with this breach.  A number of malicious attacks have already begun to lure innocent people into providing credentials based on the fear and uncertainty around this breach.   Your banks and email providers will NOT be sending messages related to this.

Finally, use a password management app to protect your online credentials.

• Whether your preferred device is Windows, Mac, Linux, iOS, or Android, there are free apps out there that can help you organize and protect your online passwords.
• Lastpass, 1password, and keepass are the most popular and cover a range of devices. 

 

References:


http://www.pcmag.com/article2/0,2817,2475964,00.asp
http://www.cnbc.com/2016/09/22/yahoo-data-breach-is-among-the-biggest-in-history.html
https://www.thestar.com/business/2016/09/23/rogers-email-users-warned-in-massive-yahoo-data-hack.html
http://www.computerworld.com/article/3077478/security/linkedin-s-disturbing-breach-notice.html
https://techcrunch.com/2016/05/31/recently-confirmed-myspace-hack-could-be-the-largest-yet/http://www.forbes.com/sites/gordonkelly/2014/05/21/ebay-suffers-massive-security-breach-all-users-must-their-change-passwords/#5d0270b13c15

Treat Your Key Pairs Like Passwords!

I just had this conversation with a friend, and decided to pull this old blog over to here to stir some discussion...


We have all been taught the Best Practices for Password Management.  There is no shortage of publications providing guidance on password management.

1. Don't use Personally Identifiable Information (PII) in your password
2. Don't use any word that can be found in the dictionary 
3. Use a different password for online banking, social networking, and email
4. Do not share your password with anyone.... ANYONE
5. Create a complex password including one or more non-alphabetic characters
6. Create passwords at with at least eight characters
7. Change your critical passwords on a regular basis (although this theory is being challenged)

So why do we not have these same discussions around Certificate or Key Pair Management?

(This is not a trainer on cryptography, but rather a discussion on proper management) 

• An SSLCertificate (x.509) is used to secure your webite or service from tampering.
• SSH keypairs are used to secure your authentication to a server or service.
• pgp keypairs are typically used for signing or encrypting files or mail.
• RSA tokens are used typically to provide a more secure second factor of authentication

These provide similar functionality as a username/password.  They provide authority as to who you are, to the system you are communicating with. They also provide the user with a sense of security/confidentiality.

However, keypairs and certificates, like passwords, can be compromised!   Even the mighty RSA SecureID is not impervious to attack.

 Typically, ssh keys are used to automate authentication to a host. That said, according to ssh.com

 "About 10 percent of all SSH user keys provide root access, creating a major security and compliance issue"

Many administrators use the same keys across multiple hosts. Similar to using the same password, this could be an issue when that key is compromised.  These very people are also the ones who have sudo access to privileged resources. A compromised machine could be silently used for a man in the middle attack.


I suggest that we need to start managing keypairs and certificates in a similar fashion to passwords.


Keypair  best practices:

1. Create a corporate policy for Keypairs and Certificates!
2. Treat your passphrase as you would a regular password (rules above)
•      When creating a keypair, do not use a blank passphrase
•      Don't use Personally Identifiable Information (PII) in your passphrase
3. Use different keypairs for critical systems, privileged access, and regular access
4. Do not share your private key with anyone.... ANYONE
5. Change your keypairs on a regular basis (maybe not as frequent as passwords, but...)

Beyond simply managing your current keypairs and certificates, you should do a discovery to see how many stagnant or unused keypairs are in your environment.   Both Venafi and SSH.Com have discovery tools that will assist in identifying how prevalent keys and certificates are within your environment.  They will scan your network, and catalog existing SSL certificates and assymetric keys, providing pertinent information regarding expiry, ownership, strength, etc...

There are many companies in the marketplace that provide x.509 / SSL Certificate discovery and management, but few have stepped up yet for managing those critical ssh/and pgp keypairs.  

Ok, I've started the discussion...  let's talk... 

Update:  IETF: Managing SSH Keys for Automated Access - Current Recommended Practice

   This document presents current recommended practice for managing SSH
   user keys for automated access.  It provides guidelines for
   discovering, remediating, and continuously managing SSH user keys and
   other authentication credentials.

 Resources:

Good Practices for using SSH

Private Key Management: Best Practice Tips From the Real World

Comodo SSL Certificate Discovery Tool

Digicert SSL Certificate Discovery Tool 

Verisign Certificate Management
SSH Auditing - New Detected Vulnerabilities and New Features for Nessus

SSH Key Management Gathering Intelligence About Your SSH Keys 

And Now for Something Completely Different!