Is LastPass’s Hack the Last Word?

In a word: hardly. LastPass getting breached seems like the equivalent of Fort Knox getting breached; it’s not supposed to happen. So far as we know, none of the gold, which represented the monetary value of US currency in circulation, was ever taken from Fort Knox. But password manager LastPass was breached, and data was taken.

The implications are stunning, to say the least. We’ve put our trust in password manager programs, and LastPass compounded the problem for its customers by being breached twice and not being as quick or transparent about it. From all reports, the latest breach occurred in late August when access was gained to parts of their developer environment through an individual compromised developer account. They said the intruder took some source code and proprietary technical information. In mid-September, they reported that the intruder was in their system for four days, but the incident did not involve any access to customer data or encrypted password vaults.

Just after Thanksgiving, LastPass reported that the knowledge gained from the first breach was used to breach the system again, and that the hacker gained access to certain elements of customer information. Just before Christmas, the hacker got customer account information such as names, billing addresses, email addresses, telephone numbers, and their encrypted vaults. They hastened to add the data was strongly encrypted and required decryption of the customer’s master password.

The bad news is that this was a series of breaches; not good. Over time, the attacker was able to target a separate employee to gain two critical pieces of information: access keys to a cloud environment and decryption keys for that cloud environment. This means the attacker was able to easily download copies of those vaults and the other customer data there.

Although each customer’s vault was encrypted, the vaults contained unencrypted information. The attacker likely downloaded all the available information from each and could the unencrypted info to try to crack the master password by brute force.

LastPass doesn’t have the best track record in the industry, and what happened there can happen to any password manager. But you can take steps to minimize the impact if it happens to your password manager.

We highly recommend that you activate two-factor authentication (2FA) for every web-based account you have. Some will give you the option to verify a specific computer, phone or tablet one time, while others will require verification every time you log in. Most systems work through text messages to cell phones because you’re most likely to have your phone with you. Some 2FA systems will send you an email with a code to enter or a link to click. They’re good if your email is secure.

So, make sure you secure your email accounts. Require 2FA – to your cell phone if possible – to access your email account from the web. List a secondary email address in case there’s a problem. It can be through another email provider, or it can be a person you trust.

2FA works with password managers, and it’s effective if the PW manager hasn’t been hacked. If the data is unencrypted, it could have been stolen (another good reason to set up 2FA for a text).

You can manage your password manager and enhance security by keeping it updated. You can change your master password at any time, and you can use the manager to change your passwords at any time. The programs offer random generation of passwords, and you can take advantage of that. It takes away any excuse you have for using the same password for multiple websites.

You can back up your password manager by downloading your website login info from the manager. Most people download the info to a .csv or .xls spreadsheet file. It’s a good idea to do this periodically and store a hard copy in a safe place. If you decide to change password managers, you can export your file to a new password manager. We suggest you create a new master password if you do that and then create new passwords for each account.

There are ways to download your password list with encryption, but they can be a little complicated. Call us – 973-433-6676 – or email us to set up a time for us to walk you through it. You can also contact us with any questions you have about password managers – selecting one or installing one.

The Ill Winds of Solar Winds

Look for a continuing fallout from the breach of Solar Winds, the giant technology management company that was responsible for the high-level federal government systems that were hacked last year. The hack is top of mind because some of our most sensitive systems were hacked, but businesses were affected, too. It’s time to look at the world of big data management.

The lesson we all need to learn from the hack of Solar Winds is that nothing is truly, truly safe. We don’t know where government agencies and private industry systems were breached – and how badly they were breached – and when it comes to the government systems, we’ll probably never know. But I don’t think we’re going out on a limb by saying that 1.) Solar Winds will need to work extra hard to regain the confidence of customers (and their customers, too) and that if 2.) they don’t succeed in repairing their systems and reputation, they’ll join a lot of other companies on technology’s garbage heap. From our various industry contacts, we had heard customers wanted to leave Solar Winds for reasons other than security.

The big data management companies should be subject to much more scrutiny by government oversight and by their customers. Strict government oversight similar to what we do to monitor CIA activity is necessary because of the extremely critical and sensitive nature of government work. Industry regulation is required to set standards for performance and accountability.

How much oversight and regulation are needed is a political question. What is not political is the need to keep our systems secure and, where possible, insist on transparency in letting us know when things go wrong. Dependency is critical because every system is so intertwined. It’s easy to see it if you look at it like a wheel. In the case of Soar Winds, look at them as the hub, and then look at every organization in their customer list as spokes connecting the hub to the rim. The rim is everyone who does business with any one of the spokes.

Solar Winds and its customers are not the first victims of sophisticated hacking, and unfortunately, they won’t be the last. Google has experienced problems, including an email issue last month, and Microsoft has had its share of issues. Look at what our nation went through with security for our elections.

As individuals we can demand that big data management companies take greater care, but we also need to own our security and asset protection. A lot of it is technology-based. We’ve implored everyone over the years to keep all operating systems, networks and application software up to date – to make sure you download and install updates, security patches and bug fixes. We’ve implored everyone to have all data securely backed up and to have a plan to get your assets – like money in your bank account – when you need them.

Beyond that, be critical of information requested when you fill out forms. Why does somebody need your social security number? Even for a job application, does your prospective employer need that information before they’re ready to do a background check or pay you? Don’t be afraid to question a request or demand a satisfactory answer. For companies where you have critical relationships, like your bank, maintain personal contacts. Know that you can pick up a phone and actually talk to a real human being when you’re concerned about your asset. We can help you with the technology part of security. Call us – 973-433-6676 – or email us for a security audit or to discuss applications and processes that can keep your computers as safe as possible when a big data manager is breached.

Healthcare and Ransomware

As many of you know, our family has spent a lot of time in hospitals over the past 30 days. Thankfully, we’re all healthy – and the doctors have been great. But looking at their technological support systems as a patient, parent and IT specialist, I could use an electronic sedative.

Judging from what I see in news reports, hospitals seem to be prime targets for ransomware. That’s a lot of sensitive data to hold hostage, and I have a greater appreciation of the consequences now than a month ago. Every hospital room I was in had a computer. Every member of the medical staff who examined Charlie or me had to login to enter all the data used to update our charts. Every medication we were given was logged into the system. The process created an information lifeline that was critical for every step in our treatments.

The data the hospitals used to treat us was entered before we were admitted. The doctors who examined us previously entered notes into our electronic charts. The results of COVID tests were entered. Everything, it seemed, had to be verified at every stage of our care. It was comforting to know that every caregiver had access to the latest information on a screen, where it could be clearly displayed without the need to decipher somebody else’s handwriting.

But what happens when the technology breaks down? What would have happened if just before surgery, a hacker had invaded Charlie’s chart or mine and held the records hostage as the anesthesiologist was about to administer drugs? What if one of us had a bad reaction to anesthesia during surgery? That’s not the best time for us to begin hostage negotiations, and even in the willingness to pay ransom, it’s not the same as going online to pay your credit card bill.

I’d feel a lot better about healthcare if the hospital systems put the same resources into information technology as they do into their healthcare technology. I saw truly amazing systems to treat us, but the news reports tell another story. IT systems, even in large systems in large metropolitan areas, are antiquated and don’t get regular updates for security patches and bug fixes. If I were prescribing a remedy, it would be to update those systems immediately.

And as large hospital systems acquire smaller, financially strapped hospitals, it’s even more important to take that update medicine. With telemedicine becoming more common, there’s more interaction with a variety of technology systems and networks, so I would demand the hospitals build electronic fortresses.

The same goes for physicians’ offices, regardless of whether they are part of a hospital system or in some other network. As patients, we regularly use the medical systems’ portals – websites – to access records, refill prescriptions and use other essential information. What if the doctor’s system goes down? What if someone is having a life-and-death emergency during a hostage negotiation because the doctor’s IT system was hacked?

To borrow an old phrase: Physician’s office, update thyself.

At the same time, we need to keep our systems secure. The hospital and office systems we deal with are likely to have done everything right. But if we leave a door open in our own system, it could be the opening a hacker needs to get into a healthcare system and hold critical data hostage.

We can help you make sure you keep up your end of the deal. Call us – 973-433-6676 – or email us to arrange for a security audit of your system. For hospitals and doctors’ offices, we’re always happy to provide a second opinion.

Home is Where the Hack Is

Don’t think your home is too small to be a hacker’s target. The recent invasion of a young girl’s bedroom through a camera system has sparked a lawsuit and some hot discussion about who’s at fault. Ultimately, you need to make you cover all the bases, and the Department of Homeland Security offers some help in making sure you know where the bases are.

DHS rightly states what we think is obvious about the two common misconceptions home users share about the security of their networks:

  1. Their home network is too small to be at risk of a cyberattack.
  2. Their devices are “secure enough” right out of the box.

Besides those misconceptions, home networks – no matter how many smart devices or dumb devices they connect – have many moving parts. In addition to cameras and smart speakers, to name just two, our networks include routers, computers, mobile devices and TVs. So, even though you may think you have a strong username and/or password for every device, there’s a possibility you can miss one key setting – or there’s a possibility that someone using your network has the weak link in your security chain that provides outside access.

The DHS checklist, which we summarize below, is a good place to start. It reiterates a lot of actions we’ve told you to take over the years, and it’s a good refresher.

  • Update your software regularly. Besides adding new features and functionality, software updates often include critical patches and security fixes for newly discovered threats and vulnerabilities. (See Understanding Patches and Software Updates.)
  • Remove unnecessary services and software. They can create security holes in a device’s system that could lead to a larger attack surface of your network environment. This is especially true with pre-installed trial software and apps installed on new computers. Remove what you don’t use.
  • Adjust factory-default configurations on software and hardware. They’re intended to reduce the troubleshooting time for customer service. Harden them to reduce vulnerabilities.
  • Change default log-in passwords and usernames. Most network devices are pre-configured with default administrator passwords to simplify setup. They’re not secure. Change them.
  • Use strong and unique passwords. Choose strong passwords and don’t use the same password with multiple accounts. (See Choosing and Protecting Passwords for more information.)
  • Run up-to-date antivirus software. A reputable antivirus software app can automatically detect, quarantine, and remove various types of malware, such as viruses, worms, and ransomware.
  • Install a network firewall. It can block malicious traffic from your home network and alert you to potentially dangerous activity. When properly configured, it can also serve as a barrier for internal threats, preventing unwanted or malicious software from reaching out to the internet. We can help you configure them.
  • Install firewalls on network devices. In addition to a network firewall, consider installing a firewall on all computers connected to your network. We can help you configure them, too.
  • Regularly back up your data. Consider using a third-party backup application, which can simplify and automate the process. Be sure to encrypt your backup to protect the confidentiality and integrity of your information. Data backups are crucial to minimize the impact if that data is lost, corrupted, infected or stolen.
  • Increase wireless security. Follow the steps below to increase the security of your wireless router or ask us for help.
    • Use the strongest encryption protocol available. DHS recommends using the Wi-Fi Protected Access 3 (WPA3) Personal Advanced Encryption Standard (AES) and Temporary Key Integrity Protocol (TKIP), which is currently the most secure router configuration available for home use.
    • Change the router’s default administrator password to deter an attack using default credentials.
    • Change the default service set identifier (SSID), the “network name” that identifies a wireless network. Make it unique and not tied to your identity or location.
    • Disable Wi-Fi Protected Setup (WPS). A design flaw in the WPS specification for PIN authentication significantly reduces the time required for a cyberattacker to brute force an entire PIN.
    • Reduce wireless signal strength to reduce your electronic footprint.
    • Turn the network off when not in use or automatically disable the Wi-Fi at specified times to prevent outside attackers from breaching your home network.
    • Disable Universal Plug and Plan (UPnP) when not needed. Recent large-scale network attacks prove that malware within your network can use UPnP to bypass your router’s firewall to control your devices remotely and spread malware to other devices.
    • Upgrade firmware to enhance product performance, fix flaws, and address security vulnerabilities.
    • Disable remote router management to guard against unauthorized individuals accessing and changing your router’s configuration.
    • Monitor for unknown device connections to monitor for unauthorized devices joining or attempting to join your network. Also see the manufacturer’s website for tips on how to prevent unauthorized devices from connecting to your network.
  • Mitigate Email Threats. Phishing emails continue to be one of the most common and effective initial attacks. They prey on the human element – the weakest component in every network – by persuading a user to click on a link or open an attachment.

All the steps you can take are common sense, but they’re often overlooked in our hurry to get a new product or feature online. The hacker looks to exploit momentary carelessness. We can review your home or office network with a security assessment and help you implement any of the steps in this checklist. Call us – 973-433-6676 – or email us for an appointment.