Do You Trust Data-recovery Providers?

Data-recovery service providers are tasked with saving important data for you when something goes wrong — a drive crashes or storage device is dropped, and no backup is available. But do you trust them with the important data you let them recover or could they actually be a source for a data breach?

A survey of 769 IT professionals published this week finds those surveyed need to find out more about the third-party data-recovery services their organizations use. For example, according to the survey, 67% felt that encryption they had in place protected their organizations from data loss or theft during the data recovery process. But encryption keys are often handed over to the third-party data recovery service provider as part of the process, according to the study done by Ponemon Institute.

Ponemon’s “Trends in Security of Data Recovery Operations” report says of the 87% of survey respondents who said their organization had at least one data breach in the past two years, “21% say the breach occurred when a drive was in the possession of a third-party data service provider.”

Source…

VoIP Ideal Platform For Controlling Botnets

Botnets and their masters can communicate with one other by calling into the same VoIP conference call and exchanging data using touch tones, researchers demonstrated at Defcon.

This gives the botmasters — whose top goals include remaining anonymous — the ability to issue orders from random payphones and disposable cellular phones, say researchers Itzik Kotler and Iftach Ian Amit of security and risk-assessment firm Security Art.

Using phones and the public phone networks eliminates one of the prime tools bot fighters have: taking down the domains of botnets’ command and control servers, the researchers say. If the botmaster isn’t using a command and control server, it can’t be taken down.

In fact, the botmaster can communicate with the zombie machines that make up the botnet without using the Internet at all if the zombies are within a corporate network. So even if a victim company’s VoIP network is segregated from the data network, there is still a connection to the outside world.

In addition to its stealth, the VoIP tactic employs technology that readily pierces corporate firewalls and uses only traffic that is difficult for data loss prevention software to peer into. The traffic is streamed audio, so data loss prevention scanners can’t recognize patterns of data they are supposed to filter, the researchers say.

The downsides of VoIP as a command channel are that it severely limits the number of zombie machines that can be contacted at once, and the rate at which stolen data can be sent out of a corporate network is limited by the phone system. But Kotler and Amit say the connections are plenty big to send commands in.

During their demo at the conference, the pair had an Asterisk open source IP PBX stand in as the corporate PBX. A virtual machine representing a zombie computer on a corporate network called via TCP/IP through the PBX and into a corporate conference call. A BlackBerry, representing the botmaster dialed in over the public phone network to the same conference call.

Read More…