Security Confidential S1 E5 Tyler Smith

Tyler Smith: Welcome to Security Confidential by Dark Rhino Security, where we get together and talk about all things information security.

Manoj Tandon: Hey Tyler, how are you doing?

Tyler Smith: I’m doing good, man. How are you today?

Manoj Tandon: Hey, real good. Real good. It’s partially sunny outside. Locked at home, can’t complain.

Tyler Smith: Yeah, it’s pretty sunny here, too. But yeah, I would kill to be able to go outside and do something.

Manoj Tandon: Likewise. So, given the fact that we’re severely limited in our movements, we thought we would chat a little bit about working remotely. That seems to be the topic of the last several weeks as, for obvious reasons, everyone is working from home.

Tyler Smith: That’s correct. It’s been surreal to say the least.

Manoj Tandon: Yeah. You know, there’s been an exponential rise, and I’ll go on public record as saying that with a lot of people working from home, I see a percentage of them not coming back to the office. So there’s going to be a shift in the way in which work gets done that will be everlasting from this whole coronavirus episode, if you will.

Tyler Smith: Yeah, I agree. It’s never going to go back. You can’t put this back in the bottle. It won’t go. Yeah, you’re exactly right. In fact, there was an article I was reading—I forget which magazine or online publication had it—but Zoom has gone from 843 million meetings a day to 400 million a day. I don’t remember whether it was for the day or the week, but in either case, it’s a huge jump.

Manoj Tandon: Yeah, I think it said it was 200 million daily users, which was the one that I read, which is up from 10 million prior to that. So it’s pretty impressive.

Tyler Smith: It is, and they seem to have attracted themselves into the spotlight. I mean, we know Zoom has been around for a long time, as have the likes of GoTo Meeting, Hi-Five, and a bunch of Skype. I mean, there’s a bunch of video conferencing systems, including Microsoft Teams, that are available to people out there, but Zoom has kind of become a de facto standard, for lack of a better word, that people have been using. They’ve attracted a lot of spotlight because of a bunch of security issues that have come to light recently.

Manoj Tandon: Quite a few. And it’s kind of funny that no one was really paying attention because these aren’t really new concerns. They’ve just been brought to the forefront by all of this.

Tyler Smith: Yeah. I mean, you’re exactly right. Zoom’s been around for a long time. People have been using it, and no one’s paid attention. And it works well. I mean, it’s simple. You create a meeting, you dial in, and away you go. Right.

Manoj Tandon: Right. Exactly. And really, I think this highlights a larger lesson that everybody can learn from this, and that is: this is the nature of security. It’s not a new thing that’s been wrong with Zoom; it’s just we didn’t know about it. And that is one of the things to me that is intriguing and terrifying about security. You cannot know what you don’t know. And this is a great example of that. All around, these have been issues with the product for a long time—since its inception, potentially. And convenience ruled out. And now, necessity is replacing convenience, and people are starting to take a closer look and say, “What are we doing here?” Only now has it come to the forefront that this is a problem.

Tyler Smith: You know, Zoom recently published that they can’t do end-to-end encryption the way the platform is architected today. WhatsApp can do it. Apple has implemented it into their messaging apps, but Zoom cannot implement end-to-end encryption. This has been there forever, as you are saying, and now that it’s become a necessity, it’s become evident.

Manoj Tandon: Yeah, nobody can ignore it anymore. And that’s one of the things that really put it on my radar. I think it was the New York City schools, who said you’re not allowed to use Zoom because of the security, which really took me aback.

Tyler Smith: Yeah, they did that. And you know who else did that? Elon Musk did that. SpaceX has banned the use of Zoom, and Zoom’s got at least two class-action lawsuits against it right now. And just today, one of their shareholders has filed a case in federal court against them for security issues.

Manoj Tandon: Yeah, that’s pretty huge. But the thing is, again, I wouldn’t say that any one of the issues that I’m aware of about Zoom is the type of thing that would take a Herculean effort to remedy. Now, that’s me—I’m definitely armchair quarterbacking it here—but all these little things add up to be big problems. One of the things that you had shared, an article with me, was about these people—I can’t remember the term that they use for it, but basically just people joining Zoom meetings at random.

Tyler Smith: Oh yeah, Zoom bombing. They call it Zoom bombing.

Manoj Tandon: Zoom bombing. That’s what it’s called. Yeah, I knew it was something over the top. And if you think about it, it’s kind of funny because if you don’t take the time to set up those security measures for the Zoom meetings and pay attention to applying them, like who you let into the room or who you give the password to, you could potentially have any kind of person join the meeting and not know who’s on your phone call.

Tyler Smith: And everyone loves the convenience of not doing that. By default now, Zoom has set it to where you have to have a password, and you can certainly enable the functionality to allow people into a meeting in spite of them having a password, but you can turn all those things off permanently.

Manoj Tandon: Yeah. And what do people do when it comes to security? If there’s anything that’s inconvenient, that gets hooked right out the window.

Tyler Smith: Exactly. I’ll use the example of our own company at Dark Rhino. We have a mixed bag of video conferencing apps. We use Zoom for some of the customer service people, and we use Hi-Five pretty much as the de facto standard for everybody else. But one of the biggest complaints we get with Hi-Five is it doesn’t work.

Yeah, it doesn’t work; it’s unreliable. But what’s really going on is that as a security company, we have federated to the Hi-Five environment. So, if you don’t log in through single sign-on, you can’t get at it. And if you don’t log in through single sign-on and you don’t have the apps configured, whether it be on your iPhone, iPad, or on your laptop, then you can’t get to the screens that allow you to add people as they are dialing in. That’s all done by design so that we know who is attending the meeting, when they’re coming in, and when they have left. And yes, a lot of people in our company travel, or used to travel, I should say, and it was always convenient to have it where you just one-click start a conference and away you go, which is something you can do in the Zoom world by disabling a lot of those security features. But then you open yourself up to all kinds of problematic situations that people are finding out the hard way.

Manoj Tandon: I have to say that I was among the people that couldn’t get it to work. I think part of it is just educating end users on how they’re supposed to use the product. It doesn’t have to be a laborious effort, but my problem was that I came at it like it was a Zoom-type thing. I just expected to click it and for it to work, and that was not the case. So, I’m guilty just like anybody else. Even though I’m a security professional, we’re still human beings, too. And convenience is, well, convenient.

Tyler Smith: Convenience is convenient. Convenience takes a front seat to security. It’s unfortunately the way things are, and now you’re seeing reports of people getting Zoom bombed, where unknown people are entering the meetings and displaying, in some cases, illicit materials to everybody else that’s on the call. They’re wreaking havoc on some of these phone calls. So, for anyone that’s going to Zoom, I guess the advice would be at a minimum to make sure that you have turned on meeting passwords, you have patched systems, and you enable the ability to add or disapprove people from joining the meeting. I realize that what I just said there is going to be massively inconvenient from the way people are used to using it, but if not, then caveat emptor.

Manoj Tandon: Yep. Exactly. And that’s the thing. I mean, there’s a number of great articles out there that are fairly technical. One of the ones that I really love, I will put into the show comments so you can read it. It’s done by a security researcher named Bruce Schneier. I probably screwed that up, but Bruce puts together articles that I really love because it breaks it down and hits all of the big problems with this. And you know, one of the ones that’s really scary is there are problems, first of all, with Zoom saying that they’re doing AES 843 encryption, but when a company researched it, they found out that they were actually only doing AES 843 in ECB mode. ECB mode is an Electronic Code Book. It’s basically a block cipher, and it’s not very secure. What I’m getting at is it’s a long way from 256. If you say you’re doing 256 and you’re not doing 256, that in and of itself is a problem. Well, Zoom also was routing calls to a couple of servers in China that were whitelisted.

Tyler Smith: Yeah, they were. I think that was the same company that found that. Citizen Lab, I think, is the name of the company that found that stuff. It is very interesting, especially given all the things going on with China and what we know about intellectual property theft and efforts around stealing companies’ intellectual property and how that’s tied to the Chinese government. I mean, another thing that he cited in his article was talking about a vulnerability that was discovered. I believe this was disclosed around April 1st. I’m not really sure on that one; I haven’t done any deeper research, but apparently there is a way for an attacker to use a chat window to send someone a string of text, and if they click on it, it dumps a whole bunch of their NTLM hashes and information to the address that’s in the link. That is because of flaws in how Zoom interfaces with the browser, I believe, if I’m not mistaken.

Manoj Tandon: Well, one thing, Tyler, I will say in all of this is I have to give credit to their CEO. He’s at least come out on public record and has very much admitted there are security flaws. His guidance was that the system was designed to enable rapid collaboration; security wasn’t at the top of mind when they—I’m paraphrasing—but that essentially is what he stated. A lot of times you see CEOs get out there when their companies are caught in a difficult situation, and they’re not completely truthful, but it seems like Zoom is taking some responsibility for it. They’ve frozen future feature development to work on the security gaps that they have. So, while the current situation is not ideal, I think in the long run, they’ll probably come out of this a much stronger company.

Tyler Smith: Oh, for sure. Yeah. That’s the thing: if he’s taking it head-on, which he is, they’ll fix these issues. Like I said, first of all, nobody knows what they don’t know. Now that they know this is the case, there are some other issues which it looks like they’re fixing, and those revolve around privacy. I think those were the major issues cited by the school system in New York that said, “We’re not allowing anyone to use Zoom because of privacy concerns.”

Manoj Tandon: Well, SpaceX has got sensitive information, right? And they don’t feel it’s a reliable system to do that. I know a lot of companies right now—I heard Sephora, the cosmetics retailer, let 3,000 people go, and they did it over a conference call. I don’t know if that was a Zoom meeting or not personally, but if you are having sensitive discussions with employees, first of all, I hope you’re not having them. But if unfortunately you have to have them, you might want to absolutely consider the privacy issues that go with that and be sensitive to it and cognizant before discussing them in a public conferencing application, if you will.

Tyler Smith: Yeah, exactly. And the other thing that I would say is almost all of these companies have guidance on how to apply security as effectively as possible. I would say go to whatever you’re using, and if you can’t find it, ask their support to direct you to it so that you can ensure that you’re applying all the security measures that are appropriate. Because if you just use—and again, I don’t want to beat up Zoom because they’re just the most relevant example of the hour—but if you look at Zoom and what they did, if someone had applied proper security, most of these things would not have been an issue. Most of the more serious things, anyway, surrounding unauthorized people joining the meetings and that sort of thing. The problem is most people use Zoom the same way I use Zoom, which is: “I need to talk to these people right now.”

I’m going to click the link and send it to these people. In that instance, it’s one of those things where in the military we have this saying that speed can be your security if you’re moving quickly over open ground. The enemy doesn’t have time to adjust and attack you. Whereas other times you’d use stealth. So, if you’re just throwing up a tactical meeting real fast, speed can potentially be your security. But if you’re planning a meeting where you’re going to divulge secrets, it’s probably a good idea to take all the security measures recommended by the vendor and apply all of them for that meeting.

Manoj Tandon: This just serves as a segue into the second part of this, Tyler, which gets into remote work and what companies are doing beyond the world of Zoom. There’s a lot of security firms that have been researching this, and what we’re about to go next is an area where you can probably find a statistic to match whatever point of view you have. But I will preface the start of this conversation by saying that yet again, what you were describing earlier as basic hygiene-type measures that should be taken also applies to the other technologies that people are using when they are doing remote work. The one that first comes to mind is RDP. Here’s what I have seen and read recently in our industry rags in the world of cybersecurity: basically, for an average cost of $6 a credential for an RDP credential, you have available to you 7,843 credentials in China, 6,843 credentials in Brazil, 3,602 in India, and 1,335 in Spain. I won’t read the list, but in every country out there, you can basically buy these credentials, and they are the gateway to lateral movement inside a company’s network. A lot of times people are compromising these networks and sitting silent for several weeks or several months until they are ready to launch their malware attack, which is usually typically ransomware, and they get hit hard. What we have seen—again, there was one statistic out there—is that there’s a 41.5% increase in the number of devices exposing RDP to the internet via port TCP 3389, which is the standard RDP port, and there’s a 36.8% increase in the non-standard port of 843 to enable RDP.

Tyler Smith: Sometimes it’s necessary, but if you’re not doing any kind of IP filtering for the source of that RDP connection, then you’re basically saying, “I’m betting there isn’t anybody out there who can get in here,” rather than making the much safer bet of, “I’m betting the guy at this IP address specifically, and only this IP address, is going to be okay once they authenticate to this system.” And that’s really where RDP is a very weak substitute for something more appropriate like VPN. You can really lock VPN access down a lot tighter than you can RDP access, especially given the fact that a lot of systems that we’re talking about with RDP access are going to be things like servers, whether they be application or web servers. Very rarely is it going to be, “I have to have RDP open so I can get to my desktop at work,” because most users now are using laptops if they need them. They’re just going to take that home. So that’s the scary thing about RDP: a lot of these RDP connections that are popping up are people who were working in an office and said, “Oh geez, I’ve got to open this up so I can do my work from home because I can’t leave my house because of this whole COVID crisis.” And that’s where a lot of it’s coming from. But the vulnerabilities that traditionally have popped up—if you go and look at vulnerabilities tied to RDP, I don’t know off the top of my head, but I’m guessing that there are quite a few of them.

Manoj Tandon: Yeah. You know, one thing you read about is a lot of the folks who have enabled RDP in haste have typically set these encryption settings to “client compatible,” which is a very weak encryption. That allows for the easier decryption of sensitive information. Potentially people haven’t enabled or haven’t implemented network-level authentication via RDP.

Tyler Smith: Yeah, and what’s funny is this is nothing new. The FBI has been warning people. I think it was in 2018 the FBI sent out a warning, which is not a common thing for them to do unless it is very serious. They’re not flippant about it. But the FBI came out in 2018 and they were like, “Hey, you guys should really watch out. Hackers are increasingly abusing RDP.”

Manoj Tandon: Oh, yeah. I mean, it’s a very easy way in, right?

Tyler Smith: It is. And that’s the thing: a lot of these people were under the gun, and because of that, they set this thing up. They didn’t block stuff appropriately, and as a result of that they’re now sitting there wide open. It’s literally like leaving a screen door unlocked in some cases.

Manoj Tandon: It very much is. And the advice there would be, at a minimum, enable network-level authentication. Make that a priority, right, and use strong encryption if you’re going to use RDP. But even there, there are instances where you need it, as you were saying, but your suggestion was to go to potentially something much more secure with VPN.

Tyler Smith: Absolutely. There’s no question that RDP is a very poor substitute for a solid VPN that’s backed up by solid rules and authentication. Those rules are in place to determine who can access these devices. Now, I’m not saying that RDP is bad, because once your VPN connection is established, then RDP is controlled and behind a firewall rule that’s filtering out what users can access said devices. Now it’s much less risky. You’ve authenticated the user. They have a session in place, and you know that they are now internally on your network because they’re connected via VPN, and you can monitor everything that they’re doing. Whereas when you just have a direct RDP connection, unless you have appropriate measures on that device—whatever it is, a server or an endpoint—that are telling you what’s going on and then you have someone monitoring those through a SIEM, you’re pretty much in the dark about what’s happening.

Manoj Tandon: Well, and I’m going to underline one other word. First you said SIEM. A lot of the smaller companies that have RDP, or are even using VPN, can’t afford to implement a SIEM. And if you don’t have one already, you’re not going to do it inside of a week, right? It’s not going to happen. So, the word you said was “strong VPN,” and I think that’s really critical. It can’t just be VPN; it has to be a very strong implementation of VPN. You might have heard that Genomics had one terabyte of data stolen in spite of having VPN installed. They got taken for a ride, and the NSA in 843 warned organizations to patch Pulse Secure, Fortinet, and Palo Alto VPN. This is the National Security Agency. Now, again, what are they advising? Basic things. Just like we’ve been talking about, a lot of basic things. Security hygiene: patch your damn systems. It just seems like companies have a hard problem with this. I don’t know what it is, but they vacillate on this concept for a lot of time, and then they get hit.

Tyler Smith: Well, I think a lot of it comes back to this mindset within companies that I’ve seen, where nobody wants to do anything that could potentially break something. This ubiquitous—in air quotes—”something” gets broken. “Oh, well, I don’t want to patch whatever because it’ll break something, and then I’ll get in trouble.” Honestly, traditionally, that’s how people were being rewarded for their efforts to try and keep things up to date and working. When you break something while you were trying to make sure that it was patched and available, that would often become a career-limiting move. Many people I know and have had to work with are very, very risk-averse from a job perspective, and that, I think, makes people drag their feet like crazy about doing simple things that they know they ought to be doing. “Well, why wasn’t this ever patched?” “Well, because we wanted it to work; we didn’t want to break anything.” When you look at some of these VPN concentrators, I mean, I know there’s a company out there—I won’t say who—but there’s a company that’s using a VPN concentrator that’s getting close to retirement age if it was a human being. It was technology from the mid-90s. Of course, that technology spanned a solid decade, and they bought it towards the end of that decade. Nevertheless, the first iteration of this technology is in its 40s, and this company is still using it. It didn’t start out life as a VPN, but it morphed into that, and a VPN concentrator is what it became. But the technology they have was installed every bit of 20 years ago. It’s that kind of stuff that is out there on people’s networks. Smaller companies don’t have these kinds of problems, but when it comes to having a VPN, you’ve got to maintain it. It’s just like any other security tool. Just like with Zoom, we didn’t know Zoom had all these issues. And now that we do, everybody’s very cautious about it, and people are saying, “Oh, we don’t want to use that because it’s not safe.” While you’re saying that, be aware you may be standing within an organization that has issues that make Zoom’s problems look like a joke, right under your nose. It’s just that nobody’s taken the time to pop the hood, as it were, and take a look. If you’re trying to do work from home and you’re trying to do remote work, it’s not that difficult. There are a lot of solutions that’ll fit just about any budget. There are even free solutions out there. If your engineering savvy permits you entry to the dance, you can get a free VPN solution, but you have to know how to set it up, maintain it, integrate it with your systems, and control it and keep it up to date.

Manoj Tandon: And that for a small business may be difficult. You know what one thing that’s also happened here, even with larger companies: they should really consider looking at the cloud as a great way to mitigate some of these security issues. I’ll give you an example. Typically when you’re connecting offices, it’s typically site-to-site, and you can have whitelisted IP addresses that allow you to connect from site to site. But now when people are working from home and working remotely, those IPs are typically dynamic. Comcast, AT&T, and Verizon for the home user—home users don’t have a static IP typically. So, you really have to have some kind of an authentication portal that validates those users. And that’s where technologies like Okta come into play, where you can have multi-factor single sign-on in a total cloud-based environment and ensure that the person accessing that network is in fact that person and not somebody else. There’s the bar for entry. It’s just which one do you want to pay for?

Tyler Smith: Well, here’s the thing, though. Right now, if you are a 25-person or less organization, we can get you into Okta for free. If you are a larger organization, we can get you into Okta for the next six months for free. So if there was a time when people are considering a movement to a cloud strategy, single sign-on MFA is a great way to begin that.

Manoj Tandon: The thing with companies that are smaller—not to beat clichés to death, but what’s the strength of being smaller? You’re more nimble, right? That’s the old adage. And if you’re smaller and you’re more nimble, you can make these adjustments pretty darn quickly. One of the things I’ve been impressed with, given this whole coronavirus and COVID destruction of the norm, is that these larger companies are pivoting like they are mom-and-pop shops. It’s been pretty crazy to watch companies go, “Yeah, we’re going to change to everybody doing this,” and they’re multinational corporations. It’s been pretty impressive. The thing that companies moving to the cloud have to realize is you still have some work to do on the security side of things. You will need to take care of the same basic security items. The difference is you don’t have to worry about feeding and caring for the infrastructure itself in the same way. You’re still going to have to configure your networking, your firewalls, and keep up with your authentication—who has access to what, when, how, and why. There are numerous examples out there of companies that fail to do that and realize, “Oh gosh, we’ve left an entire S3 bucket just bare to the world.” Many times you hear about that, it’s because there’s a security researcher who found that and disclosed it responsibly. What really is scary is: how many times have the bad guys found those things, and they’re not disclosing it to anybody? They’re just taking the data and selling it. That’s why there is a reason that companies exist in the security space. If you’re in a smaller company and you need help with this stuff, shop around, find a partner you can trust, and let them guide you through this. Obviously, we would love to help you with that, but I understand it’s not always possible. But definitely, whoever you go with, get some help, get it figured out, and make sure you’re doing it right. That way, you only have to do it once.

Tyler Smith: That’s very sage advice. On that note, I think this has been a good conversation, and I hope our listeners find some bits of wisdom. It’s about the basic blocking and tackling: still patching, making sure you are observing good security hygiene, and using common sense. If you continue to do so, you will fare quite well.

Manoj Tandon: Thank you for joining me, Manoj. I appreciate it, and thank you everyone for listening to today’s podcast. Like I said earlier in the show, we’re going to include some of those articles we were talking about in the show notes, so please check those out. Also, please subscribe to our podcast, and we will see you all next time. Thank you.

Tyler Smith: Have the bad guys found those things and they’re not they’re not disclosing it to anybody. They’re just taking the data and selling it. So um that’s why it really is there is a a reason that companies exist in the security space and that is you know if you’re in a smaller company and you need help with this stuff find find shop around find a partner you can trust and and let them guide you through this. Uh, obviously we would love to help you with that, but uh, you know, I understand it’s not always going to be the possible. We’d love it, but not always possible. But definitely, whoever you go with, get get some help, get it figured out, make sure you’re doing it right. Um, and that way you only have to do it once.

Manoj Tandon: That’s very sage advice. And on that note, I think this it’s been a good uh conversation and I hope our listeners find some bits of wisdom and you know it’s about the basic blocking and tackling still patching making sure you are observing good security hygiene using common sense and if you continue to do so you will fare quite well.

Tyler Smith: Thank you for joining me Manoj I appreciate it and uh thank you everyone for listening uh to today’s podcast. Uh, like I said earlier in the show, we’re going to include the some of those articles we were talking about in the show notes. So, please check those out. Also, please subscribe to our podcast and we will see you all next time. Thank you.