Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
JPMorgan Hack: 2FA MIA In Breached Server
Threaded  |  Newest First  |  Oldest First
Technocrati
Technocrati,
 User Rank: Ninja
12/24/2014 | 8:49:25 PM
J.P. Morgan and The Big Hole

"....the big hole that led attackers to the data was the lack of two-factor authentication of one of the bank's network servers."

 

What can you say about this ?   Seriously two-factor authentication ?!    This is simply blantant carelessness by admins and the Bank itself.  I am not about to let Chase off the hook for this in it's entirety, but looking at it from a micro-level it is clear ( to me at least) that someone was asleep at the wheel.  Taking their job for granted maybe ?  

Whatever the case, it does not speak well of Chase ( I am not sure anything could actually) nor does it speak well of their IT department.

I wonder if this is the same (IT) group that handles high frequency trading and the rest ?   If not get them on this issue - they have a proven track record of success.

Dr.T
Dr.T,
 User Rank: Ninja
12/27/2014 | 8:43:54 AM
Re: J.P. Morgan and The Big Hole
I agree. You can actually put two-factor on servers to decrease risk of exploits, but that being the solution for their hack is that realistic.
Technocrati
Technocrati,
 User Rank: Ninja
12/27/2014 | 9:02:50 PM
Re: J.P. Morgan and The Big Hole

Dr.T      That is what I am saying, two-form factor authentication should have been a basic requirement.   This is a Bank not an online site selling t-shirts.   Someone ought to loose their job(s), but this Chase, where your account is more likely to be closed than any potential security hole. 

Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
12/29/2014 | 11:13:25 AM
Re: J.P. Morgan and The Big Hole
What's most disturbing here is that we look to financial institutions as the "gold standard" for security. If one of the biggest of these institutions didn't perform basic security best practices, we should be very, very worried about the other banks as well as other industries.
Technocrati
Technocrati,
 User Rank: Ninja
12/29/2014 | 1:52:18 PM
Re: J.P. Morgan and The Big Hole

What's most disturbing here is that we look to financial institutions as the "gold standard" for security.

 

@Kelly       Your point is absolutely correct, there is no argument there.  But I ask, was this assumption ever realistic and earned ?   The Banks will argue they have a low rate of breeches   Well what is that actually due to ?  It has been implied that the financial industry was the best in this regard because after all - security is in their best interest.

And that is where the issue of security becomes blurred IMO.   What is the business that Chase (in this case) is in ?   It is not the security business nor altruism.   It is deposits and profits.   That is is all Chase and any other financial institution is concerned with because that is their business.   

This issue of security, (oh well ) that is regulated by the Government, in this case the 3rd. party to absorb blame should something go wrong,  Which ironically is needed because without it (Government) nothing would happen in a consistent way.

I refuse to see this latest "dropped security ball" from Chase, Sony ( and Target for that matter ) as purely a technical issue - that is too easy in my opinion.   Nor ignore that this is a reflection of their culture and business practice in general.  There is no shying away from this IMO.   

 The reactions of Chase  ( the delayed announcement..etc) and Sony ( it's everyone's problem response) only underscore the fact that these companies are not in the business of security nor apparently in employing it effectively.

jamieinmontreal
jamieinmontreal,
 User Rank: Strategist
12/30/2014 | 10:48:29 AM
Re: J.P. Morgan and The Big Hole
@ Technocrati  "these companies are not in the business of security"

Very true, but then again we can't expect every company not "in the business of security" to be driving security as a prime business goal - hence the need for regulations.

Then there are layers upon layers of security to sift through, physical, virtual, software defined, hardware based - thousands of vendors and applications all vying for center stage in the CISO's strategy and yet he/she has to produce something concise for the board that explains what they can and will secure, how much that will cost over time and how effective they expect the "solution" to be.   The board is also not expecting a treatise on 25 different products that will each require maintenance and support on an ongoing basis.

Organisations which do something other than security to earn a crust won't and shouldn't move focus from core business to security.   Like "marketing" in the 70's / 80's and "IT" in the 80's / 90's data security is a cost to the company's bottom line that doesn't necessarily deliver tangible benefits.

The goals for the companies who are in the Security world on all layers should be to make easy to implement and manage systems and building suites of products that demonstrate EXACTLY how they address various regulatory standards.   Imagine being able to easily deploy a suite of solutions to exceed various regulatory requirements.  NERC, FERC, FINRA, SOX, GLBA, Hipaa, other PII regs... the list goes on.

The onus is on the security related organisations to make their products as easy as possible to implement and develop some solid, demonstrable track records in how they prevent attacks from succeeding and / or minimize effect of any breaches have if / when they occur.   Think of the AV industry in the early days... people would cancel contracts because they saw no value in the AV software, then the smarter AV firms started presenting how many "threats" they "stopped" - how many organisations now run without something checking email and web traffic?

My predictions for 2015 and security?  
  • New Security industry standards as opposed to Regulatory compliance becoming a driver  "Industry standard X will help you meet the following Cyber security regulations..." kind of a thing.
  • Consolidation of industry players, MSPs, SIs, Resellers, VARS, LARS, Providers, consultants coming together to create security driven services and bundling products that work well together.
  • Shifting budgets away from CapEX to Operationalised models with hybrid cloud coming to the fore.   This will be in tandem with a shift in focus from perimiter "build me a bigger wall" security to knowledge based "who are you and what do you want" security.   Identity management will become a critical enabler of this flexible, cloud based, spinup/spindown Information technology infrastructure.

 
ODA155
ODA155,
 User Rank: Ninja
12/30/2014 | 1:11:47 PM
Re: J.P. Morgan and The Big Hole
@DR.T...
"I agree. You can actually put two-factor on servers to decrease risk of exploits, but that being the solution for their hack is that realistic."

I believe you mean 2FA will prevent unauthorized access, 2FA will not "decrease risk of exploits".

@Technocrati...
"I for one already know Chase is using "smoke and mirrors" when it comes to security.   They are doing no more than is required by law, and that apparently isn't enough."

You "know", that would insinuate that you are a Chase insider, are you... please share.  "They are doing no more than is required by law...", information security is a "Cost Center"... we do not generate money for the company, we spend the money the business makes, so if you work in InfoeSec you would not be surprised by the statement you made, pissed or upset, yes but not surprised.

@Kelly Jackson Higgins...
"...we look to financial institutions as the "gold standard" for security." Sad to say, but I'd put more trust in security for casinos or the porn industry, but that's just me.

@jamieinmontreal...
I believe the problem is that companies want it both ways, they want the government to protect them from events like North Korea haking their business or Cyber Warfare, but they when it comes to regulation or compliance, they want to write the rules that decide what compliance is. Either way there is another problem, any law and or compliance regulation that addresses cyber security must be constantly reviewed and adjusted, it cannot remain static. After every data breach there is something to be learned and in my opinion this is how it should be done... along with stiff penalties and jail-time for non=compliance.
Technocrati
Technocrati,
 User Rank: Ninja
12/31/2014 | 4:42:09 PM
Re: J.P. Morgan and The Big Hole

@ODA155    Happy New Year to you as well  !     No I am not a Chase insider,   I should have said " I am reasonably certain...." instead of I know. I would never work at Chase , though I guess I could be bought.  : )  

No I am just a citizen and admin who has not quite gotten over the financial industry induced depression quite yet.   My opinions have also been formed by being a former customer of theirs - the bank is simply terrible.  If they invested as much in security as they do for expansion( a Chase on every corner ring a bell ?) , this issue probably would have never happened.

Rumor has it they are the oldest Bank in the U.S. and they act like it - so it is with great glee that I expose a few more aspects of Chase other than their inability to safeguard the data entrusted them.

I am patiently waiting for the next blunder by Chase ( and Sony for that matter) because it is sure to happen.  Just in the case of Chase though, we won't know exzactly know when the latest breech happened until they are apparently good and ready.

It may be time to remind Chase execs again, that neither they nor their vaunted business is above the Law.

Technocrati
Technocrati,
 User Rank: Ninja
12/30/2014 | 10:08:43 PM
Re: J.P. Morgan and The Big Hole

@jamieinmontreal        You raise some excellent points about this issue of security.   And I do certainly agree that the Security industry does not do itself any favors with the customary convoluted software which would tax the best admins among us.  

 It reminds me of troubleshooting a firewall about 10 years ago - the manual at the time was the size of a book you might see in Law school or Congress.  It was a major challenge to sift through an interface that was even at that time confusing at best.   I finally did get access through a port that was needed, but it was one of my most challenging projects up until that point.   So I understand security is no easy job, but vendors can and should make things much easier for admins.

And you bring up another great point about the vastness of security layers.  This certainly makes this issue even more difficult.    Not to mention the regulations.

But I think what annoys me most is what Kelly mentioned earlier in the thread, if we can't depend on those in the the financial industry to take those steps that mere mortals fear to tread, what hope do we really have ?

Sony is a prime example of this - many believe that there is a separate group which took down their Playstation network.     So not only have they been breeched, it is by two distinct groups !    What security hole are these companies overlooking ?   I know security experts hate to think they don't have a solution, but in Sony's case  - this appears to be true.

But in the case of Chase ?     There is simply no excuse, ( not to imply there is one for Sony either) these companies have more than enough resources to get the best experts.   This did not happen and why ?   Because as you mention (and I also agree ) security is seen as an expense and it is clear companies have a conducted risk analysis on the amount of bad press and potential loss that a breech might cause.   

I like your ideas for improvement - I hope the industry hears us because it is obvious that the practices that are in place  -  Just are not working.

ODA155
ODA155,
 User Rank: Ninja
12/31/2014 | 11:03:37 AM
Re: J.P. Morgan and The Big Hole
@Technocrati...


After reading you last post I agree that while most security software does demand a higher level of attention, some may even call it babysitting, I disagree with the notionthat the applications are the problem. What I see is that the companies or the individuals responsible for bringing in these security systems are;
  • doing a poor job of product research, evaluation and planning on how to insert them into the current infrastructure.
  • turning the systems over to already over-taxed, under-staffed sysadmins who put security behind operations and performance.
  • security systems turned down or alerts being ignored

You can also add to the equation that unless the company in question is some huge deep pocketed intity, they probably do not have security people who specialize in the more technical aspects of these systems. How many IT shops are short sysadmins, do you really think these companies are going to hire a security persion that ONLY sits in front of a consol and monitoring a SIEM... (which by the way is a very credible argument)?

Personally, I think the whole mindset of what a security department needs to be revisted, especially how it's managed, staffed and funded. In most companies securitydoes have a place at the table, but it's only advisory, that is until something bad happens and then everyone want to blame a certain system because it didn't do what it was supposed to do, but when fully investigated you'll learn that the system did what it was designed, configured or changed to do, but alerts were ignored or the user community ignores policy or policy was not changed to include that shiny new system that wassupposed to protect everything.

I could be wrong, but that's how I see it.

HAPPY NEW YEAR!
Technocrati
Technocrati,
 User Rank: Ninja
12/31/2014 | 5:25:06 PM
Re: J.P. Morgan and The Big Hole

@ODA155    I agree.  Software is just one piece of this puzzle.   And I thank you for taking the time to do the deep thinking on the issue.  I agree with your listed shortcomings, chief among them is research and incorporating security tools within the current infrastructure.

And it sounds simple but you know someone was alerted and apparently it was ignored.  That is an aspect that makes this all the more reason that someone should loose their job over this.   Which we are and will continue to wait on.

Regardless your points are well taken, and it might be wise for Chase and all the rest of these companies to take heed to your recommendations (and to anyone who cares to comment ) because if this continues to happen, it won't continue to be funny.

xmarksthespot
xmarksthespot,
 User Rank: Strategist
3/9/2015 | 5:47:25 PM
Many systems secure without two factor authentication
Like many breaches, we do not have all the information about the hack.  Was a password sniffed from a system or was a hash cracked?  A truly random password with a length of 12 characters using letters, number and special characters will not be cracked, possibly negating the benefit of 2 factor authentication.  As with most hacks, there were probably multiple, basic measures that were missed leading to the possibility of exploit, but we can't know for sure without all the details.

 





 
Technocrati
Technocrati,
 User Rank: Ninja
12/24/2014 | 8:53:21 PM
J.P Morgan: Because We Said So.........

"...The JPMorgan hackers were able to access more than 90 of the bank's servers, but were detected before they got to sensitive customer financial information."

 

Chase really expects the public to believe this ?    Of course they do - they are Chase after all.   This is literally amazing, I believe the word is ludicrous.

Dr.T
Dr.T,
 User Rank: Ninja
12/27/2014 | 8:46:30 AM
Re: J.P Morgan: Because We Said So.........
It may simply mean sensitive information such as account number, SSN and balance are kept in the rest of the severs but it is hard to believe those 90 servers do not have PII.
Technocrati
Technocrati,
 User Rank: Ninja
12/24/2014 | 8:58:25 PM
The Real Issue of Data Breech and J.P. Morgan

Just what is Chase doing for those millions of customers whose data was compromised ?  (and an uncomfortable silence ensues).

 

I think I will just keep asking until I get an answer.  

Dr.T
Dr.T,
 User Rank: Ninja
12/27/2014 | 8:49:25 AM
Re: The Real Issue of Data Breech and J.P. Morgan
I agree. This is the main problem. Attacks keep happening, we keep reporting but nothing happens to attackers and the ones who are responsible for allowing that. That is the biggest and most important loophole in security.
Dr.T
Dr.T,
 User Rank: Ninja
12/27/2014 | 8:41:11 AM
So what?
80 million businesses email and address and phones are stolen? They did not have to steal that, we could have given them this induration. Some of these attacks are exaggerated by news channels and social media. Two factor authentication is not a solution for security problems, especially for JPMorgan.
Technocrati
Technocrati,
 User Rank: Ninja
12/27/2014 | 8:56:32 PM
Re: So what?

"... Some of these attacks are exaggerated by news channels and social media."

 

@Dr, T     I agree.  A lot of these attacks are misunderstood banter on the Net.   But what really annoys me is that Chase apparently sat on this information for a long time.   Considering they should have released this news as soon as they were aware.   Enough with how the public is going to perceive you.  

I for one already know Chase is using "smoke and mirrors" when it comes to security.   They are doing no more than is required by law, and that apparently isn't enough.

So why did it take them so long to release this information ?   Only the nieve amongst us really believes Chase or any Net facing business is ever safe from a breech.

If Chase thinks we the public would think less of them because of this, well it has long since been too late for that.



Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1142
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
CVE-2023-1143
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
CVE-2023-1144
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
CVE-2023-1145
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
CVE-2023-1655
PUBLISHED: 2023-03-27
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.