Hacker News

Quantum Computing -A Threat to Future Cybersecurity?

The current Cybersecurity architecture is based on cryptographic algorithms implemented all over the world. Authentication, digital signatures, encryption, electronic transactions, time-stamping, and secure network communication are few examples of everyday security implementations that are based on cryptography. The success of these cryptographic measures is dependent on the computational complexity of the Cryptographic protocols. For instance, the Advanced Encryption Standard (AES) used in symmetric cryptography has a key length of 128 (AES-128), 192 (AES-192), and 256 (AES-256) bits. If an attacker launches a brute-force attack against AES-128, it requires 2¹²⁷ combination of keys which may take thousands of years with current computation powers. However, with the evolution and advancement in quantum computing, the complexity of these cryptographic algorithms may reduce significantly. Although it’s a great achievement in IT development sector, it can also be a great security threat to the current Cyberspace architecture. In this article, we will discover the idea of quantum computing, the current advancements in the field, and security challenges that may arise as the quantum computing flourishes with time.

What is Quantum Computing

Quantum computing is the scientific study and advancement in computer technology that is based on quantum physics. Quantum physics is the study of energy and matter at the most fundamental (i-e atomic and sub-atomic) level. To understand quantum computing, we need to understand few quantum physics terminologies including quantum, qubit, entanglement, and superposition.

Quantum: Quantum in physics is the smallest possible unit of a physical property. In quantum computing, the quantum is the mechanics used by the systems to calculate the outputs.

Superposition: The concept of superposition can be understood with the help of a coin example. Let’s assume flipping of a coin. In classical computing, we can only predict one of two positions of the coin i-e heads or tails. However, if we can see both heads and tails at the same time and all the states in between, the coin is said to be in superposition.

Qubit: The basic unit of information in quantum computing is called quantum bit or simply the qubit. The role of qubit in quantum computing is like the role of binary bits (0,1) in classical computing. However, the qubit can hold a superposition of all possible states.

Entanglement: Entanglement is the property to correlate the results of one qubit with other qubits. This property allows adding more qubits to the system and solving exponentially complex problems.

Quantum interference: Quantum interference is the native behavior of the qubits while attaining the superposition. Reducing interference is one of the biggest challenges of quantum computers technology.

To conclude the above, quantum computing can be thought of a computation that benefits from the collective properties of quantum states. Quantum computing relies on quantum computers with three major requirements: a space to hold the qubits, mechanism to transfer signals to the qubits, and classical computers to run commands and instructions.

Applications of Quantum Computing

Although Quantum computing is at evolutionary stage, experts have predicted the future use of Quantum computing in different domains. Following is a brief summary of some of the most popular fields where Quantum computing is expected to play a major role in future.

Artificial Intelligence

Artificial Intelligence (AI) is a fast-growing field with widespread applications, such as, Objects recognition, Speech recognition, Fraud detection, Spam detection, Malware detection, etc. Although traditional computers are handling majority of AI tasks efficiently, they do have limitations while solving complex computational problems. On the other hand, Quantum computer can manage these problems with better accuracy. For instance, AI is used in diagnostics of various ailments by discovering patterns. Quantum computing can make the discovery process faster with more accuracy.

Financial Decisions

Finance industry uses different simulations and algorithms to find out the best investment opportunities. Traditional computers are used to find out the best indicators by comparing past data. Technically, the traditional computers are not good enough to make the right decisions as compared to the Quantum computers. Quantum computers, being fast and more intelligent, can make right choices of investments in a very short span of time.

Weather Forecasting

Quantum computing can also facilitate the weather forecasting sector. Traditional computing technology often makes wrong weather predictions since climate indicators change dramatically, making it difficult for traditional computers to timely and precisely predict the changes. These issues can easily be resolved with the introduction of Quantum computing in Weather forecasting field.

Optimization Usage

Quantum computing is expected to play a major role in solving optimization problems in industries using different quantum approaches (models). There are two main models in Quantum computing that are used for optimization problems. These are: (1) Universal Gate Model and (2) Quantum Annealers. Energy grids, large autonomous fleets, financial portfolio, logistic routes, and manufacturing designs are few example sectors where Quantum computing can play the optimization role.

Pharmaceutical R&D

With classical computers and technology, pharmaceutical industries spend billions of dollars and years to launch and market the product. Quantum computing can reduce this cost and time through correct drug designing, efficient testing, and faster target (patients) identification. Products designed and tested using Quantum computing shall be less prone to errors and trials as compared to pharmaceutical products prepared using classical R&D techniques.

Quantum Computing Security Challenges

Although Quantum computing is going to be a miraculous addition to the global technology, it can create undesired problems for the Cybersecurity industry at the same time. In Cyberspace, data is considered as the most valuable asset for any organization. Global industries spend billions of dollars to secure data from being hacked. The main technique used for data security is the application of encryption algorithms. Majority of the existing encryption techniques used by the enterprises are based on the idea of combinatorics, a mathematical field that deals with selection, arrangement, and mathematical operations within a discrete or finite systems. Quantum computing can solve the combinatorics quite easily to break almost all such encryption algorithms. This capability of Quantum computers is a big threat to the current encryption standards including AES and RSA public key cryptography.

Conclusion

There is a great deal of benefits for industries to adopt Quantum computing in the future. Data storage methods, processing techniques, and complex calculations in no time are the key attributes that differentiate Quantum computing from classical computing. Threat to current encryption algorithms and immense utilization of energy are the main drawbacks of Quantum technology. Many organizations have started working on Quantum-ready algorithms to counter the future Quantum threats to Cybersecurity.

What is all the fuss about F5 BIG-IP CVE-2020-5902

In a recent security update, the F5 networking equipment has been found vulnerable to Remote Code Execution (RCE) attack. The company provides a series of networking equipment collectively called BIG-IP devices. These devices are used as load balancers for servers handling requests for various applications. The affected BIG-IP devices include the following IP ranges.

11.6.1-11.6.5.1
12.1.0-12.1.5.1
13.1.0-13.1.3.3
14.1.0-14.1.2.5
15.0.0-15.1.0.3

According to the Common Vulnerability Scoring System (CVSS), the CVE-2020-5902 has a severity index of 10/10. To understand the vulnerability, we need to grasp some information about the F5’s BIG-IP and Traffic Management User Interface (TMUI).

WHAT is F5’s BIG-IP?

F5 is a multinational enterprise that mainly offers security, performance, and availability solutions for various web applications. BIG-IP was one of the startup projects of F5 Technologies offering load balancing services for networks and applications through virtual IP (proxy) concept. In layman term, BIG-IP is a specialized proxy server that resides between users and applications. Users access the desired applications through BIG-IP proxy. With the advancement in technology, the idea of BIG-IP has evolved into a software and hardware management solution, providing services like intelligent traffic management, high availability of applications, access control, security, and optimization. The following list of modules can be collectively called BIG-IP solutions for hardware and software offered by F5 Technologies.

1) Local Traffic Manager (LTM)

The LTM offers network traffic management solutions to enhance the performance and security of the applications. Think of different servers operating in a network. The LTM can help network traffic to choose the servers based on their availability, performance, and security.

2) Global Traffic Manager (GTM)

Similar to LTM, GTM has operational capabilities for global applications. The module enhances global applications’ performance and security through DNS management.

3) Access Policy Manager (APM)

The APM is an access control service that manages users’ access to applications based on their roles and requirements.

4) Application Security Manager (ASM)

The ASM provides security solutions for web applications through the deployment of web application firewalls.

5) Advanced Firewall Manager (AFM)

The AFM is a layer-specific security solution for applications. The module provides firewall security at Layer 3 (Network) and Layer 4 (Transport) against Denial of Service attacks.

6) Secure Web Gateway (SWG) Services

The SWG helps in defining and implementing web access policies for users. The module can act as a filter to allow or block web services based on the pre-defined access policy.

The TMUI is a configuration interface as shown in the following screenshot. TMUI components reside on a Linux host server.

BIG-IP & TMUI VULNERABILITY

The following figure presents a simple BIG-IP architecture where users can access the applications through BIG-IP proxy. The administrative/configuration tasks are performed with the help of Traffic Management User Interface (TMUI) which is also a part of the BIG-IP ecosystem. The CVE-2020-5902 lies in the TMUI part, also known as configuration utility.

The vulnerability can be exploited by sending a crafted HTTP request to the TMUI server.

AFFECTED BIG-IP DEVICES

The following table represents the list of BIG-IP devices that are affected due to CVE-2020-5902. The affected devices are found in both physical and virtual environments providing services like access management, content delivery control, and application gateways.

BIG-IP VERSIONS		AFFECTED MODULES
TO	FROM	AFFECTED MODULES
11.6.1	11.6.5.1	LTM, GTM, AAM, AFM, ASM, DNS, Analytics, APM, PEM, FPS, Link Controller
12.1.0	12.1.5.1	LTM, GTM, AAM, AFM, ASM, DNS, Analytics, APM, PEM, FPS, Link Controller
13.1.0	13.1.3.3	LTM, GTM, AAM, AFM, ASM, DNS, Analytics, APM, PEM, FPS, Link Controller
14.1.0	14.1.2.5	LTM, GTM, AAM, AFM, ASM, DNS, Analytics, APM, PEM, FPS, Link Controller
15.0.0	15.1.0.3	LTM, GTM, AAM, AFM, ASM, DNS, Analytics, APM, PEM, FPS, Link Controller

POTENTIAL THREATS

The vulnerability can lead attackers to steal secret credentials.
The administrative access to BIG-IP devices is possible with the 2020-5902 exploit.
Attackers can use the RCE vulnerability as a vector or entry point to break into other organizations’ network systems.
Hackers can execute arbitrary Java codes or system commands.
Deletion, modification, or addition of new files is possible for the CVE-2020-5902 affected systems.

CVE-2020-5902 IoC DETECTION TOOL

The F5 security team has introduced a Python script for the customers to check if their systems are compromised. The script can be downloaded from the following Github resource and should only be run on the F5 advanced shell (bash).

https://github.com/f5devcentral/cve-2020-5902-ioc-bigip-checker.git

The script is designed in accordance with the BIG-IP architecture to find the potential indicators of Compromise (IoCs) at specific locations/paths. The following screenshot shows all the scanning options available in the CVE-2020-5902 IoC detection tool.

Note: there is also the possibility of no traces found due to systems’ overwriting or footprints covered by the hackers. Therefore, the users are advised to don’t completely rely on the script and follow all possible mitigation/prevention measures.

TEMPORARY CONFIGURATION MITIGATIONS

The F5 security advisory recommends the following temporary mitigation options for the customers with no quick update solutions.

1) Restrict Access

The first quick temporary solution to mitigate the RCE is to block the BIG-IP access for authenticated and unauthenticated attackers using the following settings.

1.1) Self IPs

The Self IPs allow blocking all access to the Configuration utility by changing the Port Lockdown setting to Allow None. Any specific port can then be opened using the Allow Custom option.

1.2) Management Interface

The management interface vulnerability can be mitigated by allowing F5 product access over a secure network.

2) TMUI HTTPD

The TMUI HTTPD option is to prevent the unauthenticated attackers from leveraging the known exploits. The remedy requires adding the LocationMatch configuration element to the HTTPD using the following code.

1. First off, sign in to the TMOS Shell using the following command.

tmsh

2. In the next step, enable the VI editor by editing the HTTPD properties using the following command.

edit /sys httpd all-properties

3. Locate the line stating include none and replace the text with the following code.

include '
<LocationMatch ";">
Redirect 404 /
</LocationMatch>
<LocationMatch "hsqldb">
Redirect 404 /
</LocationMatch>
'

4. Save the changes and restart the HTTPD service.

CONCLUSION

The CVE-2020-5902 is a dangerous vulnerability that can take some time to resolve. Besides the F5 Technologies’ recommendations, the customers must follow the basics of Cyber-defense, such as updating the compromised versions of software, system hardening, and passwords update.

Equifax Data Breach

The Equifax data breach is one of the deadliest cyberattacks in the modern times not only in terms of affected people but also due to the intensity of accessed personal data. Equifax reported that between mid-May and June 2017, their system was hacked and the personal information of 173 million customers was exposed. Below we highlight some incites about this breach and then take a look at exactly how this was accomplished at the bottom.

Accessed information

According to Equifax, the hackers were able to access customer’s names, Social Security Number, customer’s date of birth, card numbers, addresses and driver’s license numbers.

Why this breach is one of the deadliest attacks

The Yahoo data breach in 2016 had 1 billion customers affected where only the passwords and phone numbers were accessed. But in the case of Equifax, sensitive data was accessed which means that:

Criminals can use the Social Security number to other credit accounts using a customer’s names.
Hackers can also maneuver their way and shop online using the credit card details obtained.
The hackers can sell the data to other criminals which makes the effect very grave.
An accessed customer’s data is not immune to future’s fraud, extortion and blackmail. The accessed information can haunt a customer forever.

How to find out if your information was exposed

Equifax has established a “Potential Impact” tab on its website (www.equifaxsecurity2017.com) that helps customer confirm whether they were victims or not. A customer should enter their last name and the last 6 digits of their social security number and a report indicating whether you were affected or not will be generated.

Due to the sensitive nature of social security number, ensure you are using an encrypted network and the computer is secure.

How to protect yourself from the data breach

Check your credit reports

Access your credit reports either from Experian, TransUnion and Equifax by accessing annualcreditreport.com. Monitor any unfamiliar activities and report immediately. Also, you can check the appropriate step to take by visiting IdentityTheft.gov.

Place a credit card freeze

A credit card freeze will give you a personal identification number (PIN) on your credit card files. This means that no other person can use them when in freeze mode. Freezing credit card files will ensure that your details cannot be used by another person to open a new account in your name.

NB: A card freeze does not restrict card charges and therefore, intruders can still use your card to do shopping.

Monitor your credit card and bank accounts

Use your banks to monitor your credit card and bank account activities by taking a credit or bank statements. This will enable you take appropriate action before much damage is done.

Place a fraud alert

A credit fraud alert ensures that creditors are informed that you are vulnerable to identity theft and thus should seek further clarification in case of any credit application.

So what can we learn from the Equifax data breach?

Equifax data breach brings out two scenarios about how the hack was effected:

First, either the hacked database was not encrypted. This is because, accessing encrypted data requires access to the secret key used.
Or the vulnerable application that was exploited allowed access to the data in an encrypted state.

Organizations should ensure that:

They utilize strong encryption mechanisms
Data in transit and at rest should be encrypted.
Implement multi-factor authentication for users.
Conduct regular system security audit

So lets go deeper and explore exactly how this was done

Again, if you haven’t heard already, if you live in the US then there is a high probability your personal information was hacked from Equifax. If you haven’t checked already you can see if you were a victim here: https://www.equifaxsecurity2017.com/am-i-impacted/ You should be able to enroll in their monitoring program if needed.

So what specifically lead to the breach? Well Equifax has recently stated here: https://investor.equifax.com/news-and-events/news/2017/09-15-2017-224018832 that the breach occurred due to the Apache Struts (CVE-2017-5638) vulnerability.

What makes this vulnerability being exploited disturbing is the fact that this exploit was found out in the wild in March 2017. You can see the actual exploit here and when it was published for everyone: https://www.exploit-db.com/exploits/41570/

Equinox didn’t start seeing suspicious network traffic until July 29, 2017. That means that their systems were vulnerable for five months and they didn’t even bother to update their servers.

This is all pointed out because this is the case more times than not and the reason there will always be a job for us out there to secure more systems.

Conclusion

Equifax data breach is just among the many data breaches that occur daily. Many of these attacks are never reported and thus the impact of hacking and access of crucial data and information is severe and even worse than reported. Therefore, organizations and individuals should ensure constant training in order to equip themselves.

How to Prevent Becoming the Victim of Another Hacker

Security is more important today than it has ever been in human history. It seems every week there are several new headlines regarding a firm that was razed to ground in light of a successful attack by hackers. Though these headlines merit plenty of attention, most people don’t realize that hackers target the common Internet user far more often than they do gigantic corporations. Whether you knew it or not, chances are a nefarious hacker somewhere on the Internet has had their eyes on your data at some point in your life.

Don’t believe me? Then believe Edward Snowden, who revealed how the NSA had been harvesting unbelievably massive stores of data from domestic US firms such as Google, Yahoo!, Microsoft, and others. That’s right – some of your data has likely already wound up somewhere on a storage server deep within the bowels of Ft. Meade due to their PRISM program. Countless attacks happen to regular people every single day, and the saddest part is that they could have been easily avoided. Understanding how to protect yourself from other hackers will make you a better hacker, because it will help you identify weak points in security. Let’s take a closer look at how you can better protect yourself from other hackers.

Password Security

Despite the warnings we’ve heard time and time again, you need to make sure that your passwords are 100% secure. It’s always best to store them in encrypted format, because they could easily be captured by a hacker if they are stored in plain text. Fortunately, software like KeePass will protect your passwords with incredibly strong encryption that is impossible to break. In addition, it will generate random passwords that are extremely complex, which brings me to my next point.

You can’t afford to use weak passwords anymore. Instead of using your birthdate, address, or the name of your dog as your password, it’s time to get more creative. Try to make passwords a minimum of 8 characters long (though they really should be longer), and you must make sure they contain lowercase letters, uppercase letters, numbers, and special symbols. Otherwise, chances are much higher that your password can be hacked with a dictionary based attack. While strong passwords can eventually be hacked with a brute force attack, they take much, much longer.

Stay Away from P2P

I can already hear all the Bit Torrent users groaning, but the fact is that P2P networks are incredibly unsecure. Even with a VPN tunnel, you still aren’t 100% safe. Without a VPN tunnel, other Bit Torrent users will be able to see your IP address, which by itself is incredibly unsecure. Bittorrent

But consider that you don’t always know if the file you’re downloading has been compromised. The integrity of files is easily compromised by hackers, who know how to slip code like viruses, Trojans, keyloggers, and other nefarious applications into Bit Torrent files to attack users. Even though prudent torrent users know to first scan downloaded files with antivirus software, they still aren’t perfect. If you really want to protect yourself from hackers that use P2P networks to facilitate their attacks, remember that an ounce of prevention is worth a pound of cure. Stay away from P2P networks.

Don’t Use the Internet without Encryption

I’ve got three letters for you: V-P-N. In the information age, everyone – and I mean everyone – should use a VPN tunnel every time they connect to the Internet. With exception to websites that only provide HTTPS connections, your data is frequently sent in plain text. This makes it tremendously easy for ISPs, governmental agencies such as the NSA, and all kinds of hackers to capture and read your data. The NSA has made statements in the past that claimed they only wiretap communications that are one end domestic and one end foreign in an attempt to combat terrorism. VPN

However, it seems that they were capturing domestic data as well by harvesting information from Google, Microsoft, Yahoo, and other popular technology companies. Though there is little we can do to prevent a cloud service provider from mishandling information, we certainly have the power to make our data impossible to read while it is in transit through the Internet.

Once your data is encrypted, it is impossible to read. But there are other benefits as well. VPN tunnel provide anonymity by masking your IP address, making it nigh on impossible for websites and online services to run audits that trace back to your unique IP address. Privacy is a large concern these days, and VPN tunnels will protect your data and your identity. Use them as much as possible!

Use Off-Shore Services in Countries without Governmental Surveillance

If you’re online storage provider or VPN provider is based in the United States, you really have no way of knowing for sure if the government has coerced the service provider into letting them steal your information. Though most VPN providers have no-logging policies, the government still may force them to forfeit information regarding user activities. The PRISM program by the NSA left people all around the world distrusting US-based services, and for good reason.

Final Thoughts

Most users don’t understand how to protect themselves from hackers, making it as easy as taking candy from a baby to steal personal information. Becoming a strong hacker means that you need to understand security, and the best ways to increase personal security and anonymity on the Internet include strong password creation, discretion downloading files from P2P networks, securing data with encryption, and using online services that are located outside the United States. If you fail to obey these basic principles, you make it that much easier to become hacked.