Attacks/Breaches

6/29/2018
09:35 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail

The 6 Worst Insider Attacks of 2018 So Far

Stalkers, fraudsters, saboteurs, and all nature of malicious insiders have put the hurt on some very high-profile employers.
2 of 7

Tesla
The alleged factory sabotage at Tesla has definitely stolen the insider threats highlights reel for 2018 so far. News broke via the leak of a company email from CEO Elon Musk, who alleges a trusted insider was deliberately sabotaging software systems that control the car company's manufacturing processes. Now that spin is being countered by claims from the employee that he was actually whistleblowing questionable manufacturing policies. Either way, security pros are asking why better controls weren't in place to keep an insider from abusing his privileges so egregiously.
Image Source: Adobe Stock (gui yong nian)

Tesla

The alleged factory sabotage at Tesla has definitely stolen the insider threats highlights reel for 2018 so far. News broke via the leak of a company email from CEO Elon Musk, who alleges a trusted insider was deliberately sabotaging software systems that control the car company's manufacturing processes. Now that spin is being countered by claims from the employee that he was actually whistleblowing questionable manufacturing policies. Either way, security pros are asking why better controls weren't in place to keep an insider from abusing his privileges so egregiously.

Image Source: Adobe Stock (gui yong nian)

2 of 7
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
No SOPA
100%
0%
No SOPA,
User Rank: Ninja
7/13/2018 | 9:58:34 AM
Yet Another Healthcare Breach - A Solution Soon?
Nuance is yet another healthcare breach that begs the question: When are Electronic Health Record (EHR) and medical application vendors going to wise up? In the EHR world (and even in the paper record world) de-identified patient data is an important step in the records workflow. Patient health information (PHI) from a medical record is stripped of all direct identifiers that can be used to identify the patient the record belongs to. Here's an idea inspired by that process that might actually work:

1. Any healthcare software vendor that houses patient data would be regulated to do the following:

a. Write into their PHI-housing software a feature that 1) encrypts PHI upon entry to the application, 2) ONLY decrypts the information for viewing and editing within the application based upon Multi-Factor Authentication (MFA) that could include user credentials, network IP signatures and local system certificates, etc. and 3) any attempt to extract the encrypted data outside the application database would results in a useless blob of encrypted information.

2. Any healthcare software vendor who did not execute #1 would be fined and withheld from Federal money until they achieved that task; perhaps incentives could be offered to encourage them, too.

This model is possible and while it took a long time just to move to EHRs, having the EHR and all the other medical software applications saves no money at all if they keep getting breached. The model above would protect PHI even from insider attacks because in order for anyone to read the PHI they would have to have all the required elements, including the application server, app client, local certificates, user logins, IP signatures and so on for the data to decrypt for viewing. Potentially massive PHI data breaches could be a thing of the past with something like this in place.
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
7/13/2018 | 8:26:25 AM
Re: Whistleblowing
SUNTRUST had a horrible reputation in the IT field for firing a ton of workers to train Indian replacements and sign non-disclosures.  Theyhave zero respect for IT as it relates to corp and fully deserve what they bought. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/3/2018 | 6:03:06 AM
Whistleblowing
Frankly, given the CEO's penchant for bombast, overstatement, and self-aggrandizement, I'm not entirely sure I personally find the Tesla employee's claims as untrustworthy here.

Moreover, employers tend to find whistleblowing to be just as much sabotage as actual wrench-throwing.

Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18913
PUBLISHED: 2019-03-21
Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location with...
CVE-2018-20031
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2018-20032
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon t...
CVE-2018-20034
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2019-3855
PUBLISHED: 2019-03-21
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.