Risk
10/10/2010
02:41 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Insiders Still Remain Potential Powerful Threat

While malware and hacker attacks continue to make the headlines, recent events remind us that insiders still pose a potent threat.

While malware and hacker attacks continue to make the headlines, recent events remind us that insiders still pose a potent threat.Consider Mathew J. Schwartz's story, Feds Bust Akamai Insider, about the man who allegedly tried to provide sensitive and confidential information to someone he thought was a foreign government:

According to the allegations, Doxer emailed a foreign county's Boston consulate offering to share information, stating that his goal "was to help our homeland and our war against our enemies." Allegedly, he also requested $3,000, on account of the risks he was taking. The foreign government, in turn, notified the United States government, which one year later launched an 18-month investigation.

According to Schwartz, and other reports, Doxer allegedly shared secrets relating to Akamai's IT and physical security, and shared details on thousands of Akamai customers and its 1,300 employees.

In other insiders news this week, there is the case of Rajendrasinh Babubha Makwana who was found guilty by a federal jury of planting a logic bomb on Fannie Mae's systems after getting fired. Experts have said that had the logic bomb been triggered, it could have caused millions in damage and shut down operations.

From our story, Fannie Mae Insider Convicted For Planting Malware:

Trial testimony detailed how Makwana was fired on October 24, 2008, and ordered to return all Fannie Mae-issued IT equipment, including his laptop. Five days later, however, "a Fannie Mae senior engineer discovered a malicious script embedded in a routine program," said the FBI.

"A subsequent analysis of the script, computer logs, Makwana's laptop, and other evidence revealed that Makwana had transmitted the malicious code on October 24, 2008, which was intended to execute on January 31, 2009," said the FBI.

"The malicious code was designed to propagate throughout the Fannie Mae network of computers and destroy all data, including financial, securities, and mortgage information."

Insiders like these, with legitimate access to information, are a tough threat to stop. Though the threat can be (somewhat) mitigated with increased monitoring for abnormalities in networks and systems as well as database access. That's the good news in the Fannie May story: vigilance saved the organization from suffering a successful - and what could had of been devastating - attack.

Though our own Department of Defense must not think current technologies are up to thwarting the insider threat. Why else would have DARPA announced this program to develop new technologies to spot and stop insider threats.

For my security and technology observations throughout the day, follow me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4231
Published: 2015-07-03
The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.

CVE-2015-4232
Published: 2015-07-03
Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.

CVE-2015-4234
Published: 2015-07-03
Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127.

CVE-2015-4237
Published: 2015-07-03
The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv0...

CVE-2015-4239
Published: 2015-07-03
Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report