SANS ISC: When Security Controls Lead to Security Issues

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

The job of security professionals is to protect customers' assets and, even more, today, customers' data. The security landscape is full of solutions that help to improve security by detecting (and blocking) threats knocking on the organizations' doors. Sometimes, such solutions have side effects that go to the opposite direction and make customers more vulnerable to attacks.

Here is a perfect example of security control that could lead to a critical issue. I was looking for data in VT and launched a retro search based on a simple YARA rule (I was just looking for a simple string). As usual, a retro search generates a lot of noise but I always have a look at all files, just in case... I found several emails (EML files) that contained juicy information (translated, the mail was issued from a German company):

Hello Thomas,

the mail (see below) unfortunately did not go through.
I uploaded two files to the Owncloud because they were too big.

These are stored in folder <redacted>

OwnCloud access data:

Guess what? The next three lines of the body contained:

• The ownCloud URL
•  The login and password!

Note: the URL was valid but credentials were of course NOT tested (never try this!)

I found several emails from this company and EML files were submitted always from the same API ID and from Germany. This security control was probably implemented to submit automatically suspicious emails to VT. 

When a customer asks me to have a look at their security posture, I always search for leaked data (from leaked databases, from VT, etc). And, most of the time, it works! It's so easy to find valid credentials to connect to an OWA, VPN, or services like, here, an ownCloud instance.

Based on the example above, some good old reminders:

• From a user perspective:
  • Do NOT share credentials via emails. Don't forget that emails are relayed through many relays to reach your contact and SMTP is a clear text protocol by default and NOT reliable (your email can be delayed and stored on a server while retrying to deliver it).
  • Encrypt your emails.
  • Share passwords via alternative communication channels (pick up your phone and talk to people).
• From a sysadmin or security perspective:
  • When implementing security controls, think about the type of data that will be processed (and stored!).
  • Anonymize and sanitize data before sending them to a cloud service.
  • Don't rely only on login/password, implement 2FA when possible! (in this example, ownCloud does)

Stay safe!

Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key