Following the news that a third-party to major entertainment networks such as Netfliz, Fox, ABC, etc. (a post production studio) was hacked late last year. The hacker is threatening to release episodes of unreleased shows, already releasing some episodes of Orange is the new Black. IT security experts from Prevalent, Inc., Imperva and Varonis commented below.
Jeff Hill, Director of Product Management at Prevalent, Inc.:
“Vendors are becoming particularly appetizing targets for cyber criminals for a number of reasons. It’s generally appreciated that smaller organizations rarely have the resources and expertise to invest in – and successfully deploy – the advanced security technologies necessary to quickly detect nefarious abnormalities indicative of modern attack vectors. What is less obvious to the infosec community is how a vendor like the production company in the Netflix attack provides bad actors a penetrate-once, compromise-many target. Although cyber criminals have, lately, made this look easy, compromising a network without being detected takes time, patience, and expertise, not to mention a little luck. Being able to leverage a successful attack across multiple companies that the initial victim works for is exceptionally appealing to the bad guys. The military has a term for a similar effect: force multiplication. Hackers just call it their lucky day.”
Ajay Uggirala, Director at Imperva:
“Hackers are looking for the largest payday possible. Why target an individual and request a few hundred dollars, when you can put in almost the same effort and get tens of thousands of dollars or even millions from a major media organisation? And, as in this Netflix situation, ransomware is more than just encrypting files, it can take the form of cyber extortion or data exfiltration – stealing the data and demanding payment in order not to disclose it, or stealing the data and trying to sell it on the darkweb.
Crime associated with ransomware and cyber extortion is just getting started. The potential profit to hackers is great, and the potential risk to organisational data and assets is even greater.”
Brian Vecci, Technical Evangelist at Varonis:
“If you asked Netflix, ABC, or Fox, “What’s the most important data you have?” a complete, unreleased season of one of its most popular shows would probably rank near the top of the list. You’d think the world’s leading media companies would do everything possible to secure that kind of information and prevent it from being stolen or held for ransom, but that’s exactly what’s happened to Netflix, and possibly others. Information security always involves people, process, and technology, and this latest breach shows us that Netflix and other major content producers might have some work to do with how they secure their information.
Smart organisations already know that their business is at risk if they don’t secure their data, but this breach highlights the difficulty in securing data used by third parties. Netflix and others handed some of their most valuable assets to a third party—post-production house Larson Studios—and now some of that content is either public or possibly being held ransom. You can’t catch what you can’t see, and when your data is in someone else’s hands, it can be difficult—or even impossible—to catch when something goes wrong. We don’t yet know where exactly the security for this data broke down, but it’s clear that Netflix, post-production house Larson Studios, or someone else in the chain stopped watching for long enough for the data to get stolen. Whether “thedarklord” was supposed to be able to access these files isn’t clear, but somewhere along the way defences broke down and the data got leaked. Either someone had access and wasn’t supposed to, or simply wasn’t being watched when something went wrong.”
Jonathan Dambrot, CEO / Co-Founder at Prevalent, Inc.:
“This hack continues to show the need to ensure that sensitive data is properly protected throughout the data supply chain. The boundary for protection must include every partner with access to sensitive data and systems.
“For Netflix, this must include anyone who touches its most valuable programming. Netflix builds awareness and subscription demand based on its fantastic programming, but no business can own every part of its production process. It must depend on strong, secure partners, which must be assessed as part of the contract process and monitored regularly throughout the life of the relationship.”
David Vergara, Head of Global Product Marketing at VASCO Data Security:
On the many possible root causes of the breach:
- Weak and Stolen Credentials, a.k.a. Passwords
Hacking attacks may well be the most common cause of a data breach but it is often a weak or lost password that is the vulnerability that is being exploited by the opportunist hacker. The Simple Solution: Use complex passwords and strong authentication, and never share passwords.
- Back Doors, Application Vulnerabilities
Why bother breaking the door down when the door is already open? Hackers love to exploit software applications which are poorly written or network systems which are poorly designed or implemented, they leave holes that they can crawl straight through to get directly at your data. The
Simple Solution: Keep all software and hardware solutions fully patched and up to date.
- Malware
The use of both direct and in-direct Malware is on the rise. Malware is by definition malicious software; software loaded without intention that opens up access for a hacker to exploit a system and potentially other connected systems. The Simple Solution: Be wary of accessing web sites which are not what they seem, and of opening emails where you are suspicious of their origin, both of which are popular methods of spreading malware!
- Social Engineering
As a hacker, why go to the hassle of creating your own access point to exploit when you can persuade others with a more legitimate claim to the much sought after data to create it for you? The Simple Solution: If it looks too good to be true, then it probably is too good to be true. If you were going to bequeath $10 Million US Dollars to someone you had never met, would you send them an email?
- Too Many Permissions
Overly complex access permissions are a gift to a hacker. Businesses that don’t keep a tight rein on who has access to what within their organisation are likely to have either given the wrong permissions to the wrong people, or have left out of date permissions around for a smiling hacker to exploit! The Simple Solution: Keep it Simple.
- Insider Threats
The phrase “Keep your friends close and your enemies closer” could not be any more relevant. The rouge employee, the disgruntled contractor or simply those not bright enough to know better have already been given permission to access your data, what’s stopping them copying, altering or stealing it? The Simple Solution: Know who you are dealing with, act swiftly when there is a hint of a problem and cover everything with process and procedure backed up with training.
Richard Stiennon, Chief Strategy Officer at Blancco Technology Group:
“This is a great example of why data governance is becoming so important. Final production videos are a class of information and the theft of such information poses extraordinary losses, if stolen. An information governance policy should take into account where critical content resides at all times. That content should be protected even when it’s in the hands of third party service providers. To avoid these types of losses, this type of content and all files associated with it should be securely erased when it is no longer required.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.