This email with the link to Bitcoin white paper started the revolution.
Comments Off on Blockchain Revolution
Intro
On 15th September, 2017, Equifax released the details of the security incident. Having gone through it, some questions and comments on the statements made in the article.
Timeline
“Chief Information Officer and Chief Security Officer are retiring” – Good call, CSO should always be someone how has information security background. Russ Ayres the new CSO does not have any security background either, good luck Equifax.
“On July 29, 2017, Equifax’s Security team observed suspicious network traffic associated with its U.S. online dispute portal web application. In response, the Security team investigated and blocked the suspicious traffic that was identified.” – Ok, the incident started on July 29th, suspicious traffic was blocked, what about the destination(s) where that traffic was directed at. 29th July happens to be Saturday, where most security staff has a day off, and as a result bare minimum got done.
“On August 2, 2017, Equifax contacted a leading, independent cybersecurity firm, Mandiant, to assist in conducting a privileged, comprehensive forensic review to determine the scope of the intrusion, including the specific data impact.” – The fact that Equifax engaged Mandiant, tells us that when the Security staff came in on Monday, they figured that this was bigger than what they had imagined and already knew the gravity of the situation. Equifax should have immediately gone public with what they knew about the breach.
“Over several weeks, Mandiant analyzed available forensic data to identify unauthorized activity on the network.” – What is several weeks, this means Equifax leadership is not serious about their customers data, shows sheer negligence on their part. Incidents such as this should be worked on 24×7 to figure out what happened, hacks happen over packet speed, and data dispersal happens at the same speed or even higher if the information is shared.
“Equifax also identified unauthorized access to limited personal information for certain U.K. and Canadian residents and is working with regulators in those countries.” – If a U.S. Online dispute portal was a treat vector, how was data of U.K. And Canadian residents exposed….what the hell was that data doing in US? Canadian laws specifically state that none of the Canadian resident data shall leave Canadian soil, so Equifax Canada screwed up?
Threat Vector
The attack vector used in this incident occurred through a vulnerability in Apache Struts (CVE-2017-5638), which was released to general public by U.S. Cert in early March 2017. So between March 2017 and July 30th the Equifax servers were still unpatched. This shows that the Security Program at Equifax was weak in its implementation even though it looked good on paper and to the auditors. How can a web facing server exposed to a vulnerability be exposed for four months. Diligent organization’s if they knew patching the servers would be problematic or take time, other controls such as application firewalls, more IDS/IPS rules to monitor for exploiting the vulnerability and also more scrutiny on SIEM. Looks like failure after failure, good that CSO “retired”.
Synopsis
This is an example of a catastrophic failure of security program. There may be other large/medium/small organizations that me be in the same boat.
Everyone organizations has processes and procedures, the key is to track their performance. It is via their performance that one realizes that a process or procedure needs to be tweaked. Metrics are key drivers for measuring performance.
Metrics are key to success of any program which act as key input to KPI(Key Performance Indicator) and KRI(Key Risk Indicators). Hence the Metrics, KPI, and KRI must be chosen wisely. Putting the right metrics together requires prior experience, having said that I am not saying it is impossible to do. If one does not have experience, they have to dedicate their efforts to developing the Metrics, KPI, and KRI’s. If you are not experienced , start somewhere and monitor the indicators and add/remove as time goes by. Key is being on top of your game, in this time and age IT Security landscape is constantly changing and the processes, procedures, metrics, KPI, and KRI’s are not updated accordingly, failures like Equifax will continue to plaque the organizations.
Contact me
If you have questions, find inaccuracies, or want to engage for a discussion, contact me via Twitter: http://twitter.com/secunoid
Comments Off on Analysis of Equifax communication on 15th September, 2017
Updated on 10th February 2018
Introduction
Crypto market hit an all-time high on January 7 when it reached $835.69 billion. Earlier today that number was at $438.88 billion, representing about a 50% drop.
Cryptocurrencies took 2017 by storm and the main catalyst in this meteoric rise was the advent of an
ICO, which stands for Initial Coin Offering.
ICO’s are also known as ITO, Initial Token Offering, and TGE, Token Generation Event.
Venture Funding
Since the dot-com days, when teams had ideas and needed funding to carry out their ideas, they would go to Venture Capitalists to get the necessary funding. This was a very painful exercise, and you had to present to many folks before you got the funding you needed or sometimes you got much less than what you asked for. Sometimes you would have to give your investors shares in your company.
Crowd Funding
Then came crowdfunding, which although had been in existence since late 1850’s, was embraced by the tech industry. The attraction of crowdfunding was that anybody with capital could invest in the idea, and as a result of investing you would get an early release of the product before it becoming available. Some of the first crowdfunding sites were:
DonorsChoose (2000), GlobalGiving (2002), and ArtistShare (2003). As the model matured, more crowdfunding sites started to appear on the web such as Kiva (2005), IndieGoGo (2008), Kickstarter (2009), and Microventures (2010).
Then, in 2008, came Bitcoin (aka Cryptocurrency), as an idea, and it went live 2009. Bitcoin’s main attraction was a mechanism of value transfer without any central authority controlling it and without any fees to conduct the transfers (initially fees were much less, pretty much negligible, now they are increasing). While the idea of borderless value transfer itself was revolutionary, the icing on the cake was the underlying framework, which was an implementation of the distributed ledger technology, called the Blockchain. The key ingredients of the Blockchain are(my thought):
Users: Entities generating transactions when they send/receive bitcoin.
Distributed Ledger: All transactions are written all active nodes participating in the network
Miners: Entities with distributed ledgers who are using their computers to package x number of transactions into blocks.
Proof of Work: To generate a block, the miners are given a range, within which the hash of their block should be in if the hash is within the range, the miner gets a reward, which is a bitcoin. This activity of finding the hash value within a certain range is very resource intensive and requires multiple miners working together to solve this problem. Once this block is generated, the miner announces it to the network of nodes running the distributed ledgers that the problem has been solved and they can move to solving another block. Proof of work algorithm addresses the issues with multiple miners announcing that they have solved the problem.
Malleability: Transactions written to the Blockchain cannot be changed as everyone has the same copy, no one party can change a transaction on their own unless they own 51% of the hashing power.
Altcoins
Riding on the Bitcoin’s coattails, came other mechanisms of value transfer, and as a whole, this ecosystem started to be called alternative coins to Bitcoin. Each Altcoin used their implementation of distributed ledger technology to allow users to start using them.
Ethereum
As the success of Bitcoins and Altcoins took a stronghold, the idea of, new use cases started to emerge on how to use the distributed ledger platform. Every time a use case needed to be implemented on the Blockchain, everything needed to be coded and set-up from scratch. In late 2013 Vitalik Buterin proposed Ethereum as a platform that would provide the basic framework to implement use cases without a lot of heavy lifting. Ethereum introduced ether as the cryptocurrency to be used on the platform by the users. It also introduced a programmable environment called the Ethereum Virtual Machine (EVM), this would allow users implement logic when engaged in an exchange of services, this logic was called smart contract. In addition to EVM, the platform also introduced the ERC-20 standard, which would allow anyone to create their own cryptocurrency, called a Token on top of the Ethereum platform.
It is this ability to easily issue tokens has fired up the whole ecosystem of ICO’s.
ICO
ICO’s should not be confused with IPO’s or venture funding where the life cycle for a particular startup was:
Regular funding cycle:
Idea —> Angel Funding (<$1Mil) or Venture Funding (>$1Mil) —> Operate the product, show profitability —> if further funding required –> IPO
Distributed Ledger funding cycle:
Idea —> ICO —> Operate the product, show profitability —> if further funding required –> ICO
| Feature | ICO | IPO | Angel/Venture funding |
| Security | No | Yes | No |
| Investor Ownership of the organization | No | Yes | Yes |
| Profit sharing with investors | No | Yes | Yes |
| Regulated | No | Yes | Yes |
Now if a team has an idea that uses a distributed ledge technology and they need funding, they have two choices, and they both use ERC20 as a mechanism to fund implementation of their idea:
Build everything from scratch
Use Ethereum platform
Key considerations when planning to issue an ICO
Following are the key considerations when issuing an ICO:
Smart contract in Solidity
Name of the token
Token Initials, a short name
Exchange rate of this token in reference to ether
Number of tokens to be issued
Contract security framework
Admin stuff
Of the tokens created, how many are available to the team vs public
What is the value of the token?
Will the value of the token remain the same throughout the ICO?
Generate awareness in general publication
User registration before the ICO. Ethereum Wallet Address, User details like Name, address, DOB, National ID’s, etc. How will the:
- KYC information of users is being protected?
- Tokens be issued?
- ICO duration be determined?
Smart contract development tools
Mist Browser: https://github.com/ethereum/mist , included Ethereum Wallet.
Ethereum Wallet: https://github.com/ethereum/mist/releases
Metamask: https://metamask.io/
Remix Solidity Editor: http://ethereum.github.io/browser-solidity/#version=soljson-v0.4.11+commit.68ef5810.js
Solidity Development Secure Framework: https://openzeppelin.org/
Evaluating an ICO
These are some of the key considerations when evaluating an ICO(my thoughts)
- What is the token trying to achieve/solve/distupt
- The number of tokens the issuer(s) will hold
- Which individuals are part of the ICO issue core team? What are their backgrounds, what is their track record in this space
- If there is a GitHub page, review the various repositories and see how many people are supporting it, and what percentage are active, because you could have one hundred people listed, and only five are active, not a good sign. The frequency of changes also should be the key consideration.
- How long does the ICO run for?
- What does the ICO issuer plan to do with the capital raised?
- Check for information on http://reddit.com in terms of interest amongst the community
- Check https://www.smithandcrown.com/ , what they are saying about this ICO
- If the ICO has already been issued, check http://coincap.io for its details.
- Check other news sites about info on the ICO
Contact me:
If you have questions or find inaccuracies, contact me via Twitter: http://twitter.com/secunoid
References:
https://en.wikipedia.org/wiki/Crowdfunding
Comments Off on What is an ICO?
The steps below outline how to purchase IOTA Tokens on a windows platform.
Go to http://iotatoken.io/
Access the wallet client download page by clicking on the following button
On the following page, click on the Download button to download and install the client
Once the client is installed, start the client select Lite version
Generate the seed using the following site: https://iotaseed.io/ , and paste it in the Seed / Password prompt on the client as shown above.
Once your Seed / Password has been accepted you will see
To receive IOTA into your wallet generate an address by clicking on Receive.
This will generate an address, then click on Attach to Tangle, this ensures that your address gets registered in the IOTA ledger. If it fails, try again, once successful you will see
Now you are ready to purchase IOTA from the exchange of your choice and use the receiving address you just created.
Comments Off on Buying IOTA Tokens
Android Pay Logo
Today I was making some online purchases, and it suddenly occurred to me to check if Android Pay ever did make it to Canada. To my amazement, it launched on 31st May, 2017.
At the launch, MasterCard and Visa cards from following banks will be accepted:
Bank of Montreal (BMO)
Desjardins
National Bank of Canada (NBC)
Presidents Choice Financial
Alberta Treasury Branch (ATB)
Canadian Tire Financial Services (CTFS)
Canadian Imperial Bank of Commerce (CIBC)
Scotiabank
With support for Debit cards arriving on 5th June.
As you can see none of the giants are participating at this point.
More details on Android Pay support in Canada here: https://support.google.com/androidpay/answer/7405561?hl=en
You will need Android devices running v4.4 (KitKat) or higher with NFC support to enjoy Android Pay. It is also compatible with certain apps and online services too, allowing users to complete one-tap purchases.
Android Pay has been available in the U.S. since 2015.
Enjoy mobile payments.
Comments Off on Android Pay has finally arrived in Canada