Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/10/2010
02:41 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Insiders Still Remain Potential Powerful Threat

While malware and hacker attacks continue to make the headlines, recent events remind us that insiders still pose a potent threat.

While malware and hacker attacks continue to make the headlines, recent events remind us that insiders still pose a potent threat.Consider Mathew J. Schwartz's story, Feds Bust Akamai Insider, about the man who allegedly tried to provide sensitive and confidential information to someone he thought was a foreign government:

According to the allegations, Doxer emailed a foreign county's Boston consulate offering to share information, stating that his goal "was to help our homeland and our war against our enemies." Allegedly, he also requested $3,000, on account of the risks he was taking. The foreign government, in turn, notified the United States government, which one year later launched an 18-month investigation.

According to Schwartz, and other reports, Doxer allegedly shared secrets relating to Akamai's IT and physical security, and shared details on thousands of Akamai customers and its 1,300 employees.

In other insiders news this week, there is the case of Rajendrasinh Babubha Makwana who was found guilty by a federal jury of planting a logic bomb on Fannie Mae's systems after getting fired. Experts have said that had the logic bomb been triggered, it could have caused millions in damage and shut down operations.

From our story, Fannie Mae Insider Convicted For Planting Malware:

Trial testimony detailed how Makwana was fired on October 24, 2008, and ordered to return all Fannie Mae-issued IT equipment, including his laptop. Five days later, however, "a Fannie Mae senior engineer discovered a malicious script embedded in a routine program," said the FBI.

"A subsequent analysis of the script, computer logs, Makwana's laptop, and other evidence revealed that Makwana had transmitted the malicious code on October 24, 2008, which was intended to execute on January 31, 2009," said the FBI.

"The malicious code was designed to propagate throughout the Fannie Mae network of computers and destroy all data, including financial, securities, and mortgage information."

Insiders like these, with legitimate access to information, are a tough threat to stop. Though the threat can be (somewhat) mitigated with increased monitoring for abnormalities in networks and systems as well as database access. That's the good news in the Fannie May story: vigilance saved the organization from suffering a successful - and what could had of been devastating - attack.

Though our own Department of Defense must not think current technologies are up to thwarting the insider threat. Why else would have DARPA announced this program to develop new technologies to spot and stop insider threats.

For my security and technology observations throughout the day, follow me on Twitter.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19012
PUBLISHED: 2019-11-17
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or ...
CVE-2019-19022
PUBLISHED: 2019-11-17
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git r...
CVE-2019-19035
PUBLISHED: 2019-11-17
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file.
CVE-2019-19011
PUBLISHED: 2019-11-17
MiniUPnP ngiflib 0.4 has a NULL pointer dereference in GifIndexToTrueColor in ngiflib.c via a file that lacks a palette.
CVE-2019-19010
PUBLISHED: 2019-11-16
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.