Does the leaked Stratfor password list speak positively for security awareness?

10% or 81000 passwords from the Stratfor password list were cracked in five hours using a simple password cracker and desktop computer reported the Tech Herald (Report: Analysis of the Stratfor Password List by Steve Ragan - Jan 2 2012). The simple fact is that password holds the key to the vault and a strong and secure password is the foundation of a secure system. A strong password is a function of an individual’s security awareness and psyche, as it is difficult to create and remember multiple passwords.

A positive aspect is that 90% of the passwords were not broken in less than 5 hours. These will eventually be broken because of the way the password was stored (plain hash and not further encrypted or salted, for the more technically inclined). From a technical perspective it’s a crucial flaw but from a security awareness perspective, individuals seem to have done a fairly good job on password creation. The fully decoded password list will tell the real story and we will soon know whether my deduction was correct.

The passwords which were cracked varied in length from 6 to 23 characters, were alphanumeric, and suffered from the following flaws:

• Used common words and phrases
• Used names of teams, words from religious text, computer phrases, and so forth
• Used common names
• Used passwords list available from previous breaches

Related Reads

Password, the WORST security tool we need to eliminate, but can’t

 IBM 5 in 5 Predicts the Demise of Passwords

Foreigners running an advance fee fraud racket targeting Indians caught in Mumbai

Six Nigerian nationals were arrested in India for an online prize advance fee fraud racket. While online prize money and other frauds are quite common, there were a few interesting points to note:

1. Nigerians nationals ran the scam in India targeting Indian nationals on business visas. Usually these scams are run in different countries to make prosecution difficult
2. The scamsters had in their possession many legal documents such as PAN cards and driving licenses in their names. These are documents, one should not be able to obtain on business visas
3. Their operating equipment comprised of 14 laptops, 15 data cards, seven pen drives, 23 mobile phones, printer, laptop cards, various forged documents of the Indian Customs, the Reserve Bank of India and foreign courts, and government and private company documents. Obtaining a mobile connection in India requires submission of both a Government ID and address proof.
4. They used software for generating e-mail ids and mobile numbers, randomly select them and send thousands of SMSes and e-mails daily
5. They opened bank accounts in which the advance fee was deposited and then removed through an ATM card. Bank accounts in India need address verification and other proofs which they were able to obtain illegally

What surprises me, is that if sms can be traced to mobile phones, and advance fee fraudsters use these to send their messages, why do the telecom operators or cybercops act proactively!

Read the full news report: Mumbai Police unearth phishing racket, arrest six Nigerians

For more details on these type of scams and how to avoid them:

Online Email Scams a multibillion dollar business or not? You decide

How you get suckered in Online scams and the little one can do about it?

In 2011, Online Activism and Hacktivism highlights the importance of Business Continuity Planning

Business Continuity Planning involves understanding risks such as natural disasters, facilities and supplier outages to a business, and putting into place a robust mitigation plan for prevention and response in case any risk is realized. BCP is important for both large and small enterprises. In large organizations, BCP is driven by a systemic organizational process.

Online activism in UK and Middle East, arose spontaneously  triggered by a singlular events like the death of Mark Duggan in UK—who was shot dead after being stopped by the police—and in Egypt, Khaled Said,  who was beaten to death by security forces. Protests have swept across Morocco,Tunisia, and the Gulf region. Protest were fueled by need for political reform. Pages on Facebook became a rallying point for protest, twitter and messengers were used for coordination ,and  YouTube, Blog sites and Twitter were used to report incidents live to global audiences.

In an attempt to quash the growing protests, governments started blocking or monitoring social media sites like Facebook, Twitter and YouTube. In some cases countries imposed Internet blackouts for upto five days or as in Libya, pulled the plug on the Internet. In January 2011, the Egyptian government shut down Internet and mobile communication for five days, leaving Egyptians with landlines as their only mode of communication.

The protest and street violence say the closure of business across the country and the Internet blackouts affected online communications and businesses. The blackout cost Egypt at least $90 million. A complete overview of site blockages in 2011 is available as part of the Google’s Transparency Report.

The extreme form of online activism, Hacktivism, saw significant hacks such as that of Sony Playstation Network by Anonymous, a Hacktivist group which halted the company operations for over a month and ran up a loss of 200m$. There were several other such hacktivist campaigns against banks, suppliers associated with the US government and political websites.

The three key learning from these incidents are:

1.      Online activism or Hacktivism can spontaneously result in disruption at a scale which is unprecedented. An analysis of the stability of the political environment and its impact on the functioning of the country is paramount to BCP planning.

2.      Resetting a country involves a regime or policy changes that take years. Therefore do not expect a short term effect on business operations

3.      Social unrest in a recessionary world is on an uptick and is not solely related to third world countries as believed prior

Related Reads

"Merry LulzXmas" Says Lulzsec

Ideology drives both Hacktivism and Online Piracy

The relationship between the threat of political violence and Cybersecurity attacks

Fourteen Potential Problems for Sony to Clean up Post the DataBreach

In 2011, Natural Disasters highlight importance of Business Continuity Planning

The most significant event of 2011 was the effect natural disasters had on global business. In April 2011 an earthquake in Japan, spawned a Tsunami which later went on to cripple a nuclear reactor at Fukushima resulting in a disturbance to the power grid, radiation emission, withdrawal of expat labour from Tokyo and  a  disruption in the supply chain of several global firms. In Nov 2011 floodwaters in Thailand inundated seven industrial estates north of the capital, crippling global supply chains.

Although natural disasters are not very common, the magnitude of their impact is severe, and governments are never fully prepared for such disasters because the consequences tend to be largely unpredictable. Japan, for instance designs all it’s building to be earthquake resistant. Even though Japan suffered multiple high magnitude quakes the resultant loss of life through fallen buildings was minimal, it was the unpredicted Tsunami which created a catastrophe.

Of the many companies which were affected by these disasters. Honda Motor Company was one. The company suffered lost production, stock declines and business losses. The Honda plant at the Rojana Industrial Park was a major production base of Honda in the Asia and Oceania area.

The press released by Bloomberg Oct 31 2011 “Honda Misses Profit Estimates, Scraps Forecast” redacted below, fully outlines the business impact of the disaster on the company.

“Honda Motor Co., Japan’s third- largest carmaker, reported second-quarter profit that missed analysts’ estimates and withdrew its forecasts after flooding in Thailand crippled its production in Southeast Asia.

Net income was 60.4 billion yen ($761 million) in the three months ended Sept. 30, compared with 135.9 billion yen a year earlier, the company said in a statement. That missed the 66.1 billion yen average analyst estimate compiled by Bloomberg.

Honda, which made more than 170,000 cars in Thailand last year, scrapped its full-year forecasts as it reels from a disaster that’s inundated 10,000 factories and flooded more than 80 percent of Thailand’s 77 provinces since July. Automakers will produce 300,000 fewer vehicles than expected this year, according to the nation’s automobile industry group.

Honda shares have fallen 22 percent since August, the steepest drop among Japan’s three biggest carmakers. The stock fell 3.7 percent to 2,406 yen today.

Second-quarter operating profit fell 68 percent to 52.5 billion yen, below the 78.5 billion yen average analyst estimate, with the company blaming the strong yen for eroding earnings. Revenue also missed analyst estimates.

Most companies do not actively plan or invest against natural disasters as the cost for managing such risk is high and probability of occurence low.

The three learning’s from these incidents are:

1.    Natural Disasters cannot be accurately modeled or planned for. They do happen and due diligence in site selection helps.

2.     In Thailand, costly equipment was damaged because the communication was not in an international language or as timely to foreign managers, hindering precautionary actions. this has to be anticipated and built into the plan.

3.    Time to recover varied from a minimum of 3 months onward for large firms