Research

SOHOpelessly Broken 2.0: Security Vulnerabilities in Network Accessible Services

Internet of Things (IoT) devices have always been vulnerable to a variety of security issues. In 2013, Independent Security Evaluators (ISE) performed research on IoT devices that showed how rich feature sets could be leveraged to compromise devices. Today, we show that security controls put in place by device manufacturers are insufficient against attacks carried out by remote adversaries. This research project aimed to uncover and leverage new techniques to circumvent these new security controls in embedded devices.

Read More >

Ethercombing: Finding Secrets in Popular Places

In this paper we examine how, even when faced with this statistical improbability, ISE discovered 732 private keys as well as their corresponding public keys that committed 49,060 transactions to the Ethereum blockchain. Additionally, we identified 13,319 Ethereum that was transferred to either invalid destination addresses, or wallets derived from weak keys that at the height of the Ethereum market had a combined total value of $18,899,969. In the process, we discovered that funds from these weak-key addresses are being pilfered and sent to a destination address belonging to an individual or group that is running active campaigns to compromise/gather private keys and obtain these funds. On January 13, 2018, this “blockchainbandit” held a balance of 37,926 ETH valued at $54,343,407.

Read More >

Password Managers: Under the Hood of Secrets Management

Password managers allow the storage and retrieval of sensitive information from an encrypted database. Users rely on them to provide better security guarantees against trivial exfiltration than alternative ways of storing passwords, such as an unsecured flat text file. In this paper we propose security guarantees password managers should offer and examine the underlying workings of five popular password managers targeting the Windows 10 platform: 1Password 7 [1], 1Password 4 [1], Dashlane [2], KeePass [3], and LastPass [4]. We anticipated that password managers would employ basic security best practices, such as scrubbing secrets from memory when they are not in use and sanitization of memory once a password manager was logged out and placed into a locked state. However, we found that in all password managers we examined, trivial secrets extraction was possible from a locked password manager, including the master password in some cases, exposing up to 60 million users that use the password managers in this study to secrets retrieval from an assumed secure locked state. 

Read More >

Securing Hospitals: A research study and blueprint

The research results from our assessment of 12 healthcare facilities, 2 healthcare data facilities, 2 active medical devices from one manufacturer, and 2 web applications that remote adversaries can easily deploy attacks that target and compromise patient health. We demonstrated that a variety of deadly remote attacks were possible within these facilities, of which four attack scenarios are presented in this report. To understand these ecosystems, a two year study was performed from January, 2014 through January, 2016 of critical elements within these facilities as they relate to securing patient health. Our goal was to create a blueprint --a step-by-step action plan-- that all medical facilities can follow as the foundational element in reaching full security readiness. The research was driven by a handson analysis of various healthcare systems, applications, and budgets, interviews with hospital, data center, and medical device manufacturer employees, and sourcing industry knowledge from thought leaders on our advisory board. The findings show an industry in turmoil: lack of executive support, insufficient talent, improper implementations of technology, outdated understanding of adversaries, lack of leadership, and a misguided reliance upon compliance. These findings illustrate our greatest fear: patient health remains extremely vulnerable. The output of the research is the production of a modern patient-health focused attack model, and a blueprint that advocates a phased approach to security design and implementation for healthcare facilities that focuses on the protection of patient health assets.

Read More >

See our patient monitor hack demo on CBS News

Fighting Back Against SSL Inspection, or How SSL Should Work

ISE security analysts considered the increasing prevalence of SSL inspection on corporate networks, threats to the certificate authority model that could allow SSL inspection to spread to other types of networks in the future, and how built-in browser key generation capabilities could be leveraged to achieve mutual authentication and greatly frustrate, if not prevent, mass-scale, automated SSL inspection.

FEATURED CASE STUDY: HTTPS Vulnerabilities

ISE identified 21 (70% of sites tested) financial, healthcare, insurance and utility account sites that failed to forbid browsers from storing cached content on disk, and as a result, after visiting these sites, unencrypted sensitive content is left behind on end-users' machines.

 

FEATURED TALK: SOHOpelessly Broken

ISE researchers discovered critical security vulnerabilities in numerous small office/home office (SOHO) routers and wireless access points. These vulnerabilities allow a remote attacker to take full control of the router's configuration settings; some allow a local attacker to bypass authentication directly and take control. This control allows an attacker to intercept and modify network traffic as it enters and leaves the network.

 

soho

Advisory Board

 

Larry Ponemon, Ph.D. – Ponemon Institute

Dr. Larry Ponemon is the Chairman and Founder of the Ponemon Institute, a research “think tank” dedicated to advancing privacy and data protection practices. Dr. Ponemon is considered a pioneer in privacy auditing and the Responsible Information Management or RIM framework.

Ponemon Institute conducts independent research, educates leaders from the private and public sectors and verifies the privacy and data protection practices of organizations in a various industries. In addition to Institute activities, Dr. Ponemon is an adjunct professor for ethics and privacy at Carnegie Mellon University’s CIO Institute. He is a Fellow of the Center for Government Innovation of the Unisys Corporation.

Dr. Ponemon consults with leading multinational organizations on global privacy management programs. He has extensive knowledge of regulatory frameworks for managing privacy and data security including financial services, health care, pharmaceutical, telecom and Internet.

Dr. Ponemon has held chaired (tenured) faculty positions and published numerous articles and learned books. He has presented hundreds of keynote speeches or learned presentations at national or international conferences on privacy, data protection, information security, corporate governance, and responsible information management. Dr. Ponemon is an active member of the International Association of Privacy Professionals, serving as founding member of the Certified Information Privacy Professional (CIPP) Advisory Board.

Dr. Ponemon earned his Ph.D. at Union College in Schenectady, New York. He has a Master’s degree from Harvard University, Cambridge, Massachusetts, and attended the doctoral program in system sciences at Carnegie Mellon University, Pittsburgh, Pennsylvania. Dr. Ponemon earned his Bachelors with Highest Distinction from the University of Arizona, Tucson, Arizona. He is a Certified Public Accountant and a Certified Information Privacy Professional.

Dr. Ponemon is a veteran (Vietnam War era) of the United States Navy. He is married and has two sons. Dr. Ponemon is an instrument rated private pilot.

David Finn – Symantec

David Finn, CISA, CISM, CRISC is the Health Information Technology Officer for Symantec. Prior to that role he was the Chief Information Officer and Vice President of Information Services for Texas Children’s Hospital, one of the largest pediatric integrated delivery systems in the United States. He also served as the Privacy and Security Officer for Texas Children’s. Prior to that Mr. Finn spent 7 years as a healthcare consultant with IMG/Healthlink and PwC, serving last as the EVP of Operations for Healthlink.

Mr. Finn has more than 30 years’ experience in the planning, management and control of information technology and business processes. He is focused on enabling operating efficiency and deriving business value through the optimization and control of technology. Mr. Finn’s key skills include IT Governance and Control, Project Management, Systems Selection and Implementation, Business and IT Partnering, and IT Audit, Control and Security.

Mr. Finn has presented nationally and internationally on such topics as project management, professional leadership and staff development, and privacy and security.

Finn holds a BA degree from the University of North Dakota and an MA from Angelo State University. In addition to having served on the national Board of HIMSS, he currently serves on the Privacy and Security Committee of HIMSS, as well as serving on ISACA’s Professional Influence and Advocacy Committee (PIAC). He is a charter mentor of HIMSS eExecutive mentoring program.

Joseph Macaluso, M.D. – angelMD, LSU Health Foundationns

Dr. Macaluso has a long history of accomplishment in medicine, clinical practice, surgery and urology. He maintained one of the most active urological surgery practices in the nation for more than 22 years and served as the Managing Director and Director of Research and Grants at the Urologic Institute of New Orleans for 15 years. He taught medical students and residents for many years as an Associate Professor of Clinical Urology at Louisiana State University Medical School and Charity Hospital in New Orleans. Dr. Macaluso also held the rank of Assistant Professor of Clinical Urology at Tulane Medical School. Board certified by the American Board of Urology, Dr. Macaluso has been cited by numerous “Best Doctors” lists, and was named repeatedly in Best Doctors in America. His dedication and commitment to quality patient care and research is well known throughout the urology profession. He retired from active practice in 2005.

Dr. Macaluso received his undergraduate degree in biology from the University of New Orleans and his medical degree from Louisiana State University School of Medicine. He received extensive training in General Surgery and Nephrology/Renal Transplantation prior to completing his Urology residency in 1984. Dr. Macaluso is or has been a member of more than 30 professional societies, including the American College of Surgeons, the American Urological Association, the American Lithotripsy Society, of which Dr. Macaluso was a three-time president and a member of the original founding board of directors. He is a past Chairman of the Board of Directors of the Foundation for the Louisiana State University Health Sciences Center in New Orleans, and continues in service on the board. Dr. Macaluso has served in the past as a consultant to many major pharmaceutical and healthcare corporations. He has been a leader in the area of innovation regarding health care delivery online, health systems, health policy and e-health.

Ford Winslow – Centrex IT

Ford is Chief Risk Officer at Centrex IT, a security–focused Cloud Managed Services Provider. Ford has over 15 years working in regulated IT organizations of all size in the financial services, biotech and healthcare industries and speaks frequently on Health IT topics. Prior to Centrex IT, Ford founded Abnology, a cloud provider for highly regulated companies where he created the Trusted Health Cloud. Ford is co-author of the Good Informatics Practices series of books providing industry guidance on topics including: Risk Management, Cloud and Infrastructure, Validation and Verification, Data Management, Training, and Security.

Steve Zielinski – McLean L.L.C.

Steve Zielinski is the Managing Director at The McLean Group’s St. Louis, MO office. His 25 years’ experience as a financial professional, management consultant and investment advisor to middle market institutions and businesses have provided him a strong background in buy-side and sell-side investment banking transactions.

As a former president and chief investment officer of a financial services firm, Mr. Zielinski has focused on using innovative tools and approaches to obtain financing from institutional and accredited investors, and government sources to fund ventures in cleantech, biotech, healthcare, education and agribusiness.

Before joining The McLean Group, Mr. Zielinski was an executive director and consultant at Zielinski Companies, a diversified CPA, consulting and management firm serving institutional and corporate clients throughout the US and abroad.

For nearly 20 years, Mr. Zielinski served several St. Louis community banking organizations as a legal director, bank chairman, audit committee chair, and investment and loan committee member. As a managing member and general partner, Mr. Zielinski has been involved in developing, operating and raising capital for several private placement funds.

Mr. Zielinski earned a Bachelors of Science in Management Sciences from St. Louis University. He also has completed executive and investment certification programs from The Haas School of Business at the University of California, Berkeley, University of Pittsburgh, The Wharton School of the University of Pennsylvania, University of Chicago Booth School of Business, and University of Manchester, England. He is a former president of the St. Louis University Alumni Association.

Professional Credentials

  • Chartered M&A Professional (CMAP) through NACVA
  • FINRA Registered Representative (Series 2, 7, 63, 79)
  • Accredited Valuation Analyst (AVA) through NACVA
  • Real Estate Broker (Missouri)
  • Certified Investment Management Analyst (CIMA) through the Investment Management Consultants Association
  • Accredited Investment Fiduciary Analyst (AIFA) through the Center for Fiduciary Studies

Professional Memberships

  • National Association of Certified Valuation Analysts (NACVA)
  • Middle Market Investment Banking Association (MMIBA)
  • Investment Management Consultants Association (IMCA)
  • Center for Fiduciary Studies (CFS)
  • Entrepreneurs’ Organization (EO) in association with the Young Presidents’ Organization (YPO)
  • Missouri Venture Forum
  • Chicago Social Venture Forum
  • SLU Billiken Angel Network

Shari Overstreet – McLean L.L.C.

Shari Overstreet, Managing Director of The McLean Group’s Austin, TX office, has more than 25 years’ financial, accounting, business valuation and M&A experience. She performs business valuations for many Austin-based companies, most of which are technology based.

Ms. Overstreet began her public accounting career in the audit and tax divisions of a regional and then a national accounting firm before working as an independent consultant for such clients as Coopers & Lybrand (now PricewaterhouseCoopers).

As a financial services manager for one the nation’s largest gas distribution companies, Ms. Overstreet was deeply involved in a corporate restructuring that doubled the company’s customer base while tripling its earnings per share (EPS) and stock price. Ms. Overstreet subsequently worked as financial planner/divisional controller with a publicly-traded NASDAQ firm where she served on the cross-divisional financial planning staff and performed M&A analyses. She also was appointed director of finance, administration and operations for a publicly-traded firm that develops and markets high-performance, multi-function videoconferencing systems.

Ms. Overstreet is an author and speaker on various mergers and acquisitions, capital formation and business valuation topics. She was a 2010 Nominee for the Profiles in Power & Women of Influence of Central Texas Award.

A CPA, Ms. Overstreet holds a BBA with a finance concentration from the University of Texas at Austin.

Professional Credentials

  • FINRA Registered Representative (Series 63 & 79)
  • CPA (Texas)
  • Accredited in Business Valuation (ABV) through AICPA
  • Certified Valuation Analyst (CVA) through NACVA
  • Certified M&A Advisor (CM&AA) through the Alliance of M&A Advisors

Professional Memberships

  • The Texas Society of CPAs
  • American Institute of CPAs (AICPA) including Business Valuation and Forensic Litigation Services division (BVFLS)
  • Financial Executives International (Austin Chapter)
  • Association of Corporate Growth (Central Texas Chapter)
  • National Association of Certified Valuation Analysts (NACVA)
×