Tag Archive for AES

Marriott Data Breach One Of Biggest Ever

Updated July 17, 2019 – The Brits slapped Marriott with a £99m ($124m) fine for “infringements of the GDPR.” The Information Commissioner’s Office said that Marriott failed to undertake sufficient due diligence when it bought Starwood, and should also have done more to secure its systems prior to the data breach.

___

Marriott Data Breach One Of Biggest EverThe internet is a dangerous place for data. Hotel chain Marriott (MAR) proved that once again. Marriott revealed that hackers stole personal information from 500 million Starwood Preferred Guest program participants. The data stolen in the data breach included sensitive personally identifiable information (PII).

Marriott

Marriott said it got an alert on September 8, 2018, about an attempt to access the Starwood database and enlisted security experts to assess the situation. During the investigation, Marriott claims to have discovered that the unauthorized access to the Starwood network started in 2014.

Investigators found that an unauthorized party had copied and encrypted information from the database and had taken steps toward removing it. The company was able to decrypt the information on November 19, 2018, and found that the contents were from the Starwood guest reservation database. The hotel chain then waited until November 30, 2018, to tell its customers of the data theft.

What was lost on the data breach

personally identifiable informationFor about 327 million Marriott customers, the compromised information includes some combination of name, address, phone number, email address, passport number, Starwood Preferred Guest (‘SPG’) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences. Marriott added that the data breach included payment card information. About 170 million impacted Marriott customers only had their names and basic information like address or email address stolen.

Marriott says that about 20.3 million encrypted passport numbers and approximately 8.6 million encrypted payment cards were compromised in the breach.

Chinese hackers Several sources report that state-sponsored Chinese hackers working for the intelligence services and the military were behind the attack. The stolen data would be an espionage bonanza for government hackers. Sources point out that the Starwood attacks began in 2014, shortly after the attack on the U.S. government’s Office of Personnel Management (OPM) compromised sensitive data on tens of millions of employees, including application forms for security clearances.

Sadly, the 500 million records Marriott hack only ranks as the third-largest known data breach to date. This list of fails illustrates, no matter what you’re doing online every time you put your information on the internet, you risk it being stolen.

RankCompanyAccounts HackedDate of Hack
1Yahoo3 BillionAugust 2013
2River City Media1.3 BillionMay 2017
3Aadhaar1.1 BillionJanuary 2018
4Marriott500 Million2014 - 2018
5Yahoo500 MillionLate 2014
6Adult Friend Finder412 MiltonOctober 2016
7MySpace360 MillionMay 2016
8Exactis340 MillionJune 2018
9Twitter330 MillionMay 2018
10Experian200 MillionMarch 2012
11Deep Root Analytics198 MillionJune 2017
12Adobe152 MillionOctober 2013
13Under Armor150 MillionFebruary 2018
14Equifax145.5 MillionJuly 2017
15Ebay145 MillionMay 2014
16Heartland Payment Systems134 MillionMay 2008`
17Alteryx123 MillionDecember 2017
18Nametests120 MillionJune 2018
19LinkedIn117 MillionJune 2012
20Target110 MillionNovember 2013
21Quora100 millionNovember 2018
22VK100 MillionDecember 2018
23Firebase100 MillionJune 2018

rb-

There is something else fishy here. Reports claim that the data was encrypted using AES-128 but not all the stolen data. Attackers were able to steal nearly 20 million passport numbers, and 8.6 million encrypted payment cards.

Marriott says that the attackers were able to gain access to 5.25 million unencrypted passport numbers and 2,000 unencrypted payment card numbers.

I’m sure that regulators (GDPR) and lawyers will ask why unencrypted sensitive info like passports and credit card numbers lying around waiting to be stolen?

 

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Do Christmas Lights Slow Wi-Fi?

Do Christmas Lights Slow Wi-Fi?A new holiday tradition is to spread FUD about how your Christmas lights can interfere with your Wi-Fi signal. This year’s holiday Wi-Fi FUD spreader is the UK communications regulator Ofcom. Ofcom hinted that “Fairy Lights” may slow down your 2.4 GHz Wi-Fi signal and everyone went crazy.

Christmas lightsThe theoretical science says it does. C|Net explains that Wi-Fi uses radio waves. Christmas lights emit a very weak electromagnetic field. So theoretically, they can interfere with the radio waves being transmitted from your Wi-Fi router. The more lights, the stronger the electromagnetic field. Also, the closer the lights are to the router, the more it may interfere with the Wi-Fi.

The truth about holiday light interfere

Communications technology consultant Stuart Lipoff, told C|Net how you’re affected really comes down to what type of Christmas lights you use. The older technology that was used to make the lights blink can indeed cause radio interference. The interference could happen if the holiday lights were arranged in series with each other. The total number of lamps in the string could be such that the combined voltage of all of them was equal to the 110 volts in a typical U.S. home.

Christmas lights

However modern Christmas tree lights are based on solid-state LEDs. They often use an external electronic flashing controller and do not create radio noise. However, there are some LEDs that have an extra blink-controlled chip right inside the LED bulb. It turns out that these devices also create significant radio interference. The Wi-Fi interference occurs as this internal controller cycles the LED chip from on to off. The reason is somewhat analogous to the spark problem in incandescent blinker bulbs. When the LED is between fully on and fully off it can show negative resistance that causes it to creates radio energy.

Christmas lightsYou can simulate this by taking an AM radio. Tune the radio to a frequency, not in use in your area, and switching something on and off rapidly a few times. You should hear a staticky sound. The same thing can be heard during a lightning storm.

The real Wi-Fi killers

Alina Bradford at C|Net tested the theory and found there was a slight variance, be it ever so slight. She says “the variance isn’t a big deal.”

  • PC World says the real Wi-Fi killers are households items that are on 365 days. These will disrupt your Wi-Fi a lot more than your Christmas lights. Microwaves are the worst of the lot, as it’s basically a metal box that when turned on uses high-powered microwaves at around 2.4 GHz (the same frequency as Wi-Fi). This creates a black hole around it for Wi-Fi signals.
    washing machinesOther culprits include ovens, freezers, fridges, washing machines, dishwashers… you name it. If it’s metal and has liquid-filled pipes, it’s going to kill your Wi-Fi signal according to Panda security.
    Cordless phones are also problematic. They’re often more of an issue because you’re more likely to have a portable phone on your desk than a microwave.
    Televisions and speakers are basically just electromagnets and will hurt Wi-Fi performance when placed directly near a router.
    Your neighbor’s router. Depending on how close your router is to someone else’s, there can be a direct effect on its performance. This might prove to be even more problematic if you live in an apartment. In an apartment, you could be exposed to different signals from all sides. This means that the more interference that there is, the more your router ups it’s broadcasting, This causes your neighbor’s router to do the same… which just perpetuates the problem.
    TelevisionWater pipes can also cause interference because water absorbs radio waves.
    Walls don’t generate electromagnetic fields, but they do weaken Wi-Fi signals that pass through (up to 25 dB’s can be lost).
    Humans – Yes, you too are a problem! We, humans, are 55% – 60% water, which makes us a fantastic absorber of Wi-Fi.

Things to do improve your Wi-Fi

Panda Security also suggests a few things you can do to improve your Wi-Fi.

  • Open your doors – Closed doors could effectively block or degrade wireless signals.
  • Adjust your Wi-Fi channel – The typical default is channel 6, your router may do this automatically. If you change your Wi-Fi channel you may find that there is less interference from other routers near to you. Any two channels separated by five or more do not overlap.
  • Change your channelChange your Wi-Fi Frequency The most common Wi-Fi frequency is 2.4GHz.  2.4GHz is also the most polluted. Try using 5.0 GHz. Like changing your Wi-Fi Channel your router may do this automatically. If you change your Wi-Fi frequency you may find that there is less interference from other routers near to you. You will need to check your devices to see if they support 5.0 GHz Wi-Fi, some older devices, like Apple iPhone 4’s do not.
  • Place your router in the center of your home. A router transmits the signal in all directions, so it makes sense to have it at the center of the home. Unfortunately, this isn’t always possible due to the cables that come with it.
  • Check your cables – In general, a shorter and higher quality cable will mean a faster connection speed. It is better to use Ethernet cables from your modem to a separate router than run long phone cables.
  • Invest in a new router – There’s no need to break the bank on a new, fancy router. However, some of the newer Wi-Fi routers on the market offer a notable boost in signal and speed.
  • Turn your house into a Faraday cage. Build a Faraday cage to eliminate all outside sources of electromagnetic pollution. But would also mean no telephone or FM connections.

Of course, you should also take precautions to ensure that your Wi-Fi connection is secure by putting a strong password on your router and use a modern security setting like WPA2-PSK (AES).

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Wi-Fi Charges Up Ethernet

Wi-Fi Charges Up EthernetInformation Technology prognosticators Gartner (IT) predicts that 40% of enterprises will use Wi-Fi as the default connection for mobile and non-mobile devices by 2018 according to Fred Donovan at FierceMobileIT. The prediction says that typically fixed location devices like; desktops, desk phones, projectors, and conference rooms will use Wi-Fi as their primary connection replacing Ethernet.

Wi-FI logoGartner says Wi-Fi is facilitating BYOD. The enterprise Wi-Fi network now allows workers to choose any device and move anywhere in the workplace. Gartner argues that the introduction of security measures like 802.1X augmented with Advanced Encryption Standard (AES) encryption has lessened IT’s worry about security breaches involving the Wi-Fi infrastructure. Ken Dulaney, V.P. and distinguished analyst at Gartner said;

Ethernet cabling has been the mainstay of business workspace connectivity since the beginning of networking. However, as smartphones, laptops, tablets, and other consumer devices have multiplied, the consumer space has largely converted to a wireless-first world

Facilitating BYOD

As the first connection to the enterprise infrastructure, Wi-Fi brings workers the ability to choose any device and move anywhere without worry. VP Dulaney continued;

WI-FI certifiedAs bring your own device (BYOD) has increased in many organizations, the collision of the business and consumer worlds has changed workers’ demands

Furthermore, cabling systems or even peer-to-peer (P2P) wireless solutions using technologies that offer cable replacement have had to deal with a variety of connectors challenges, such as USB and micro-USB, as video systems move beyond Video Graphics Array (VGA). The market research firm also argues that MACD costs will decrease.

MACD costsAdditions, moves, and changes are costly inconveniences that waste time for enterprise IT organizations. A move can sometimes involve cabling changes that can cost as much as $1,000 … With Wi-Fi printers, desktops, and other devices, all that is required is a cable to the power source, leaving workers free to move themselves making reconfigurations of offices easier.

Because of the many benefits of Wi-FI, Gartner VP Dulaney predicts firms are going to change how they connect;

we expect many organizations to shift to a wireless-by-default and a wired-by-exception model.

New Ethernet specifications

In order to deal with the new wireless-by-default reality, changes are needed on the wired network.  at FierceCIO reports that the vendor community is working to address the Wi-Fi first world. Unfortunately, there are two industry groups pushing their own new Ethernet specifications. Mr. Mah says that new Ethernet standards are needed to work with Wave 2 of 802.11ac wireless access points (AP) with a theoretical maximum throughput of up to 3.5Gbps.

NCaptain Ethernetew standards are needed because the existing Gigabit Ethernet is a bottleneck and current alternatives are not attractive. First, link-aggregating two Gigabit Ethernet connections for each Wi-Fi AP would need additional cabling and more expensive managed switches to support it. Using 10GbE would be overkill. Upgrading to 10GbE is a significant investment that includes new Category 6a or Category 7 cables, more power, and more cabling.

One faction, the MGBase-T Alliance, was formed in June 2014 and includes; Avaya, Aruba Networks (ARUN), and Brocade (BRCD) as well as component vendors Broadcom (BRCM) and Freescale Semiconductor. The other group known as the NBase-T Alliance was formed in October 2014. This faction consists of Cisco (CSCO), Intel, Xilinx (XLNX), Freescale, and Aquantia, a company that’s already making 2.5G/5G components.

Little agreement on standards

At the moment, the only agreement between the two factions is that 2.5Gbps and 5Gbps speeds are needed. The IEEE 802 LAN/MAN Standards Committee has set up the P802.3bz 2.5/5GBase-T Task Force to address this issue. The 2015 Q1 CommScope Standards Advisor reports that the 802.3bz Ethernet cablescommittee has decided so far that:

  • 2.5 GBase-T option will run on Cat 5e (Class D) 4 pair UTP up to 100M, and
  • 5 GBase-T option will run on Cat 6 (Class E) 4 pair UTP up to 100M.
  • There is no release date yet

The concern, however, is that vendors could jump the gun by shipping pre-standard products ahead of standards rectification, complicating matters and slowing down the development of the pertinent standards.

rb-

Remember 802.11n? Pre-standard products? Given that there is no guarantee that systems built with components from the two groups will work together. Don’t jump the gun – waiting for the standard to solidify before buying into new 2.5G/5G Ethernet networking hardware.

For now, Dell’Oro Group analyst Alan Weckel told FierceCIO is that enterprises will probably be able to buy 2.5G/5G equipment starting in Q2 of 2015. 

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Encryption on the Internet Primer

Encryption on the Internet PrimerI spoke to several of my mother’s friends the other day. They were all worried about being on the web. Kudos to these ladies for being connected at all (they are in their 70’s and 80’s), They also get a gold star for being alert enough to recognize that something on the ol’ Intertubes has changed recently.

Data theftThey hear that their information is being stolen at the banks and stores they frequent. One neighbor lady even said she was worried but the government stealing her data. I explained to the group that I too am concerned about how it seems everyone on the web is under attack lately.

I gave them the usual pointers. Don’t trust anything on the web.  Have someone (not me!) help keep their anti-malware and systems up to date. And use encryption if possible.

Navajo Code Talkers

Of course, none of my mother’s neighbors had heard of encryption. I explained to the ladies that encryption means changing a message so that anybody who heard the message would not understand it unless they knew how the message was changed. I used the example of Ig-pay Atin-lay.

  • An-cay ou-yay eak-spay Ig-pay Atin-lay? = Can you speak Pig Latin?
  • I-way ave-hay a-way ecret-say = I have a secret.

 

Then of course I was outsmarted. One of the wNavajo Code Talkers during World War IIomen chimed out, Oh like the Navajo Code Talkers during World War II. (Next time I will start with the smart answer and then go to the Pig-Latin.)  These ladies lived through the shhesh,

So that got me thinking, what does the end-user really need to know about encryption? Sure there are PKI’s, Salted hashes, Block-ciphers, and …. none of which mean anything to the end-user.

What users need to know about encryption

Miguel Leiva-Gomez at MakeTechEasier.com recently explained what beginners need to know about encryption. He says that encryption is a practice in cryptography where a piece of data is obfuscated (manipulated) in a mathematically predictable way. The manipulation makes it very difficult to recover its contents. The author says it is like my pig-Latin example, but much more complex. The mathematical equations used to encrypt (and decrypt/decode) things are called cryptographic algorithms.

These cryptographic algorithms are needed because hackers are getting smarter and sneakier. They’re compromising databases left and right. To protect your data from attacks system owners should use these algorithms to mathematically jumble up all your personal data Jumbling the data (encrypting) making it difficult (if not completely impossible) for a hacker to steal your data from that database. Mr. Gomez claims that encryption basically protects you from intrusion. If a hacker manages to break into a database and take your passwords, it would be reading something like “EAFC49BF4B496090EA2B7CA51674589” instead of “Mary_$mith.”

The article calls the jumbled-up text like “EAFC49BF4B496090EA2B7CA51674589” at the end of every algorithm is called a ciphertext. The decrypted equivalent is known as plaintext. These are very important words to remember when discussing cryptography.

The author explains that there are two ways that the plaintext “Mary_$mith” gets turned into the ciphertext to “EAFC49BF4B496090EA2B7CA51674589” and then back to plaintext “Mary_$mith.” The first method is called a symmetric algorithm:

Symmetric algorithms use a key to Symmetric algorithm:encrypt and decrypt data. The key is basically the “x” that will solve for “y” in the mathematical algorithm. The length of the key and some other properties of the algorithm determine its “difficulty.” The more difficult an algorithm is, the more difficult it is to crack it. A difficult algorithm requires immense amounts of computing power to crack. The kind of horsepower that is usually out of reach from run-of-the-mill hackers. More sophisticated attacks might use computer clusters to decipher your data. Even then, some symmetric algorithms might thwart these attacks.

Asymmetric (public key) algorithms.The second-way plaintext gets turned into the ciphertext and then back to plaintext are called Asymmetric (public key) algorithms. Asymmetric algorithms split the key into two pieces. The first is a public one (usually stored in the server). The second piece is a private one (usually stored in your computer by software). Mr. Gomez writes that asymmetric algorithms get their strength from this particular technique since a hacker will not be able to read the contents of your data even if he gets his hands on the public key (it’s only half the key).

rb-

In the end, no algorithm is created equally. All of them have some flaw or another that will be discovered in the future, so it’s difficult to know what services you should rely on.

The best advice is still the oldest advice. Look for URLs that start with HTTPS and have a little green lock in the URL line. This means some part of the connection is encrypted with Secure Socket Layer (SSL) an Asymmetric (public key) algorithm. The Internet is on the verge of a move to a more secure Asymmetric algorithm called Transport Layer Security (TLS) 

That’s why the age-old advice to keep your PC up to date is critical for keeping your personal data safe.

Related articles
  • Navajo, Pawnee Code Talkers remembered on Veterans Day (KOB.com)

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

A History of Encryption

A History of EncryptionYour personal information is under attack from the Feds, Target, Neiman Marcus, and who knows else. One of the keys to keeping your personal information personal are secure passwords. But what makes a password secure? America Online (AOL), (rb- Yes they are still around) explains the concept of encryption (converting information into code) is not new.

In fact, as you can see below, encryption started with the Spartans in 500 B.C.  Yhey would rearrange the position of letters within a text. Through the years, this process has become more sophisticated, which brings us to Advanced Encryption Standard, or AES, which is what we use today. This standard is based on computing bits, basic units of information. The bits in passwords are what help to keep your data secure. Check out the infographic to see how encryption has evolved from 500 B.C. to the present day and their tips for keeping your passwords safe.

 

A history of encryption Infographic

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.