Information leakage channels. Part 2

Ruslan Rakhmetov, Security Vision

In the last article we talked about different channels of information leaks, dividing them into 2 categories: network and physical. Despite the fact that in the last two years, leaks using networks are the absolute majority (growth from 58% to 93% of open data in the Russian Federation from 2021 to 2022), we would like to talk about other channels that were not included in the last part of the review. The fact is that open data on leaks describe not all the cases that actually happened. Therefore, we would like to tell you about other, even exotic channels of sensitive information leaks and ways to protect them.

Physical connections are not limited to the use of infected flash drives: an open port or interface can be a source of leakage. If an attacker connects their device to the company network through a physical port or an employee mistakenly uses an unsuitable cable, a new leakage channel will be created.

To protect against such attacks, companies can implement physical access security policies with periodic monitoring of ports and connections (e.g., using ITAM), video surveillance systems, pentests and employee training.

A hacker can also access information remotely through weak passwords. By searching them manually or automatically, an attacker can authorise under an employee's account with the right rights. According to current statistics, users continue to use simple passwords ‘123456’, ‘1000000’, ‘12345zz’ and others, which is simply unsafe.

We have already talked about the basics of cyber hygiene, part of the rules of which is to create complex passwords, store them in encrypted form and update them regularly. It is also recommended that you use different passwords for each account. This technique can be supplemented by implementing MFA solutions and monitoring unsuccessful authorisation attempts using SIEM or UEBA class solutions, while SOAR solutions will allow for active blocking of KM when an incident occurs.

The actions of system administrators who have left a default password on a device, such as a Wi-Fi router, can also be a mistake, allowing an intruder in the signal range to access the admin panel of a weakly protected device.

In our articles about networking in companies, we have already talked about security and central administration technologies that can be used to protect data.

A company employee can retain access to internal resources even after termination of employment. Usually this happens due to errors in business processes related to the dismissal: the account may be left in an active state, retaining the password and role model rights. In this case, the former employee can not only read the data that has become confidential to him, but also delete entire directories with files.

To prevent such leaks, it is necessary to monitor suspicious events using UEBA class systems, to build correct processes with termination of the account lifecycle using AM and to manage access lists, e.g. using IDM.

Unauthorised interception of radio signals or electromagnetic pulses can be a leakage channel if an attacker uses an RF device. This is similar to intercepting a telephone call, where a signal that was supposed to be transmitted only between the call participants is sent in parallel to be ‘bugged’ or completely redirected (as in call forwarding or using an answering machine on a mobile phone). For protection it is enough to implement encryption of wireless networks, hiding the internal network from the public list and monitoring network traffic for anomalies.

An attacker can use not only radio but also sound waves. For example, by applying AI tools, it is possible to decrypt a recording of keystroke sound while typing. For example, if a user enters a password to an internal system during the recording and the decryption falls into the hands of a hacker, the password can be considered compromised. Ina similar way, hackers can conduct an ultrasonic attack, which can primarily affect devices with voice assistants (Alice from Yandex, Assistant from Google, Siri from Apple, etc.).

Information leaks are also possible with the use of thermal imaging, as in the case of inspecting a flat in a new building, but instead of heat leakage through windows and joints, the attacker can track the ‘hot’ keys on the ATM when typing the pin code of the card, the password to enter the building or the graphical key to unlock the smartphone.

Information leaks can be caused by technical errors. For example, a vulnerability in the source code can provide unauthorised access to data to an attacker. If a programmer has made a mistake, special solutions for source code analysis (static and dynamic scanners) will enable code auditing, penetration testing, search and elimination of errors.

An incorrectly configured web server can also provide access to a database. For example, if a developer made a mistake when programming a web application, opening a vulnerability for SQL injection - it can be closed by auditing the source code or using a WAF.

A classic firewall can also let traffic from the external network into the internal network, which leads to data leaks, so it is important to audit security settings in NGFW, use the principle of ‘necessary access’ or "Zero trust ’ (depending on the chosen approach).

The threat of leakage can manifest itself when updating software and OS from untrusted sources, as well as when installing illegitimate software. You can protect against such leaks by using AM class products that monitor ‘whitelists’ and install updates from internal and trusted repositories.

Concluding the review of various channels of information leaks, we would like to focus on an important fact - leaks can be provoked not only by intruders, but also committed accidentally, without intent to offend and steal important data. That is why specialised protection means are already used in 30-40% of commercial companies.

Data leaks can also be caused by the actions of internal employees. Colleagues sharing files can violate trade secret protection policies when transmitting within the company, as well as when transmitting outside the perimeter. Protection can be provided not only by DLP solutions, but also by defining a clear role model for access to data, regular auditing of rights and monitoring of traffic within the perimeter and at its borders.

Other leaks are caused by the actions of suppliers and partners. A company's external counterparty with access to data can be subject to outside hacker attacks or accidental errors just as much as internal employees of the protected company.

We remind you of the importance of assessing and considering different security aspects depending on the specifics of the organisation and potential threats! Cyber risk management and quality threat modelling can be a good basis for security.