Data Security and Facebook

An online report published by CNET on September 4, 2019 identified that at least 419 million records  of phone numbers tied with Facebook accounts appeared in databases online. The report was based on the revelation by TechCrunch. 

The exposure identified 133 million users from US alone and another 18 million and 50 million records from UK and Vietnam respectively.  The flaw as highlighted is Lack of Password protection on the server by Facebook. Records were identified with Demographic details also.

Now the big question, does this impact my privacy and security of my data online (read facebook data too)? Answer to this is pretty simple - if your demographic data and phone number is available example - sex, country and phone number (along with Facebook's Unique User ID) it is pretty much a compromise of your personal information leaving you vulnerable to certain cyber attacks. The data can also be misused to forge your identity with the modern mechanics of hacking.

This certainly is a big mess here by the team at Facebook to have left a critical server without password, the first baseline defense mechanism to check against unauthorized access. Though the very next day or so Facebook reverted with a statement that the data has been scrapped and is no more exposed to the open web. But from the time that server would have been put in place to the time the data was reported to be exposed and the steps by Facebook to scrap the data, do you think that the data would not have been compromised?  In all probabilities it would have been.

Though this is not the first time that such exposure or compromise has been reported. We keep on hearing such cases almost every other day.  The corporates accumulate our data for their business benefits and then miss out on the aspects of security to be deployed.  As per Facebook, this server probably served the purpose of searching a person on Facebook using the Phone Number of that person. My question here is why should the Phone Number search for Facebook user be activated in the first place? That itself is a breach of privacy and compromise of data that has been provided to a service provider as a security feature for secondary authentication.  

Facebook may state that they have this feature of find by phone to be controlled by the user and if user doesn't want to have this feature on, they can restrict it. Based on this aspect, I had a few discussions with a few facebook users and majority of them (close to 65%) didn't have an idea that they can control this feature of Search by Phone.  

So, the question still looms - "Should Corporates be allowed to Introduce Features that may pose Security and Privacy threats to the users?"

New Viruses as reported

The recent developments that hackers are adopting to target the systems are pretty interesting.  The Batchwiper as detected by the Iranian CERT and the Trojan as reported with evade technology are the two recent developments.  The Batch Wiper though can be contained with certain precautionary measures, but the Trojan with evade technology would certainly be something that would create a widespread Havoc.  

With the evade technology the Anti-Virus Firms would need time and research to ensure that the right set of detection & quarantine techniques are used so as not to jeopardize the O/S routines that the Trojans use to evade the AV.

Specifically with the Trojan that is reported and that waits for the left Mouse Click routine to execute the commands is one tricky case.  Certainly, we can't stop using mouse with the fear of the Trojan getting executed.....

Time to look out and dig deeper around these aspects to ensure that the corporate as well as home users are impacted the least.....

Different views - Skype Detection - It's a Reality

I had written this article in November 2005, when there was a article published on VOIP Softwares by Jim Wagner, well the summary of the same is –

"Researchers: Skype, VoIP Are Hot And Risky" by Jim Wagner. As per this article, the research firm noted in an recent advisory, Skype doesn't leave an audit trail and could get companies into trouble on the compliance front; there's also the question of whether VoIP calls in general constitute a business record" are the words from a senior research analyst at Info-Tech.

But me and my team were already identifying and blocking skype usage in the corporate network from June 2005. Following was the article that I had written then –

Peer to Peer voice services are the talk of the Internet users. Why not, as they provide inter computer calling for free. So if you have a machine with sound card and an Internet connection, you can connect to other users using the same Peer to Peer voice service software and well its absolutely free.

Skype is one such software that has become quite popular. The developers of Skype have gone a step further in providing with service they call as SkypeOut. This is though a subscription based service but provides with a facility to Users to call landlines and cellphones for a fee

With the increased usage of Skype and other such Peer to Peer voice services, the IT Security experts started throwing up warning flags about VoIP on the corporate network and pointing to one provider in particular. Research from VeriSign and Info-Tech Research Group said security risks surrounding increasingly-popular Internet phone software could put networks at risk and should be addressed.

Quoting from article "Researchers: Skype, VoIP Are Hot And Risky" by Jim Wagner – "As it stands, the research firm noted in an recent advisory, Skype doesn't leave an audit trail and could get companies into trouble on the compliance front; there's also the question of whether VoIP calls in general constitute a business record" are the words from a senior research analyst at Info-Tech.

Somehow I disagree with the point that Skype does not leave any Audit Trail for usage. Atleast we have successfully tested and are using the detection method in live environment. The test that was conducted to detect presence and usage of Skype in the network had two instances –

1. Port based detection

For port based detection we derived that Skype tries to contact peers using TCP fixed port 54045 when a conversation starts. In case it fails on the identified port, it tries TCP or UDP random ports.

2. Signature based detection

For signature based detection packet analyzers can be used to analyze the Skype traffic, but it’s slightly difficult due to encryption. Still the conversation can be detected using custom signatures, which can look for certain pattern in the packets flowing through network gateway. Thus an alarm can be raised whenever a matching event is found

In either case, rst settings could be configured on the IDS and the skype could be blocked. Additionally, Websense could be configured in Network Sensor mode and the traffic could be blocked.