Endpoint //

Privacy

8/4/2017
10:00 AM
Hadar Blutrich
Hadar Blutrich
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Are Third-Party Services Ready for the GDPR?

Third-party scripts are likely to be a major stumbling block for companies seeking to be in compliance with the EU's new privacy rules. Here's a possible work-around.

Like a maelstrom on the horizon, GDPR — the European Union's General Data Protection Regulation — is coming, and companies both inside and outside the EU are scrambling to comply with its many rules. Among those rules is a requirement for companies that have access to user data to protect it by any means necessary. If they don't or can't, they pay — in cash, with hefty fines imposed on companies that fail to fulfill their obligations. And the EU means business; it imposed a $2.7 billion fine on Google in June over what officials said was Google's misuse of its data power.

Companies, of course, are doing everything they can to comply with the EU's cybersecurity rules, including the implementation of collaboration and information-sharing between relevant institutions (government, banks, regulators) regarding attacks and defense systems, education efforts to ensure that employees don't admit malware into the network, and appointing an officer who will be in charge of ensuring that user data remains safe. And the rules apply to all companies and organizations, anywhere, if an EU citizen can connect to their site.

Every company that does business on the Web is now busy ensuring that its security systems are up to the EU's standards. But there are data issues beyond the control of any organization in the form of the data collected by third-party scripts, which are processed and stored in databases belonging to the third-party script provider. And organizations can't do without these scripts; they provide the services that users have gotten used to and demand — such as social media, ecommerce, comment services, advertising, content distribution, site analytics, and much more — as part of their Web experience. Without these scripts, there basically is no World Wide Web as we know it, and without those services, the level of engagement on sites is likely to fall considerably.

The Security Factor
There's no way of knowing how secure the scripts are. We know that there have been numerous examples of third-party scripts being taken over by cybercrooks to pull off some spectacular hacks. There was, for example, the Stegano exploit, which compromised the computers of millions of users around the world. Stegano, which has been around since at least 2014, came into new prominence last fall when it was used to cleverly hijack readers of "popular news sites," according to ESET Research, which first published details of the exploit. Hackers used ad networks to distribute malicious scripts to run an exploit via an image's invisible alpha channel (a layer of an image meant to store data but that has no visual representation in the image).

The exploit — which didn't change the banner ad at all, making it almost impossible for a user to detect that anything was wrong — checked to see if any security software, sandboxes, etc., were present; if they were not, the exploit would redirect to a page that downloaded a payload and used regsvr32.exe or rundll32.exe to install it. The point of the exploit was to install malware that would steal user data from the webpage itself — login and password combinations or credit card numbers if they were entered into a box on the webpage — or to divert their clicks to other servers that served the needs of hackers or their clients.

In either case, the data of users was compromised — a sad story for them, and certainly a black mark on the news sites that were victimized — but under the new rules, sadness and loss of reputation are the least of the problems of the organizations whose sites were compromised. Had GDPR been in effect when the exploit was going full blast, the news sites would likely have been fined, if not prosecuted. That's how tough the EU rules are, and nearly all sites that use third-party scripts are potential victims.

What can they do to protect themselves? First of all, sites have to even out the equation and find a way to take back control of their websites. In that sense, their experience is similar to administrators who run mail servers — and whose users are plagued with endless amounts of phishing emails that seek to tempt recipients to click on a rogue link or contaminated attachment. Despite the best efforts of administrators, who have tried lecturing, hectoring, threatening, and begging users not to click on suspicious-looking links and attachments, the problem gets worse every year, with more attacks and more opened messages leading to more successes for hackers.

If lecturing, hectoring, threatening, and begging don't work, what will? One idea is separation — setting up a sort of sandbox between the mail server and the user's inbox that can examine the contents of a message. If something appears suspicious, either in the attachment or the message itself, the message can be "cleansed" of bad elements, or dumped altogether. If it works for email — and, indeed, for any Web connection — why not for third-party scripts? With sandbox-type solutions, companies can regain control of their websites while retaining the third-party services their users demand. Sites would be able to protect themselves from the unknown threats presented by third-party scripts, ensuring that not only is user data protected but that organizations are protected from the threat of big EU fines and penalties if something goes wrong.

Related Content:

Hadar Blutrich is the CEO of Source Defense. He was formerly the Chief Solution Architect at LivePerson and has led projects with many industry giants, including Bank of America, Chase, and Verizon, among others. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14633
PUBLISHED: 2018-09-25
A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The at...
CVE-2018-14647
PUBLISHED: 2018-09-25
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming larg...
CVE-2018-10502
PUBLISHED: 2018-09-24
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exist...
CVE-2018-11614
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists wit...
CVE-2018-14318
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. User interaction is required to exploit this vulnerability in that the target must have their cellular radios enabled. The specific flaw exists within the handling of ...