I had a short call with Mark Thomson, Director General at Her Majesty's Passport Office, I guess this is a lesson in the power of LinkedIn - he reached out to me Thursday night after reading my post about how convincing and sophisticated the attackers are becoming (updated based on recent events). We scheduled a brief call lunchtime Friday to discuss my concerns, more on this below, but first the context and lessons to be learnt for any organisation...
There was a twist to the phishing tale; it turns out it was in fact a legitimate SMS from the passport office. There were a number of issues that led to this confusion - primarily doing things such as asking for personal information they said they would never do (described here); and compounded by confirming it to be a scam when I emailed them a screenshot of the SMS asking if it was! When I first got the SMS it seems my spider sense was working well - I joked with a colleague:
"I'm not sure which is worse, if it's a scam, or if it's legitimate, I fear it may be the latter"
There are some important lessons to be learnt here for all organisations...
How can we possibly expect people to be vigilant and do the right thing if organisations don't follow their own guidelines? Especially when this is a function whose entire reason for being is robust identity protection.
There were a number of issues worth considering in more detail (though the first and last are by far the most important), each of which can easily be remediated if security is designed into the process:
- Problem: Link to a 3rd party in an SMS
Risk: Anyone can send an SMS or email pretending to be someone else (like this example from NatWest). This can be done by spoofing the sender email address, spoofing a source phone number, or even sometimes using a compromised account.
Remediation: Never link directly to a 3rd party in an official email or SMS; instead link to an official page (In this case one ending in .gov.uk). The linked page can explain the use of the 3rd party service on a trusted HTTPS secured page on the official site, then link off to a 3rd party if required. Though perhaps the government ought to have their own survey site...even if it's SaaS with a CNAME DNS mapping. - Problem: Their own anti-phishing team confirmed to me it was a scam.
Risk: Confusion and mixed messages could make people careless in future; or in this case drive away "customers". I wonder how many people did / didn't follow that link...those that did have learnt that it's ok to give details to untrusted sites, those that didn't missed out on trying a new convenient digital service.
Remediation: Make a list of official 3rd party links (including the whole URL in the case of surveys or sites anyone can add content to). Make it available for staff, and end users if appropriate, to check against. - Problem: The Action Fraud page threw an error when I went to report it (May have been a glitch, as it got past that point when I just tested again). Further the certificate fails Chrome's checks: "The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1.".
Risk: SHA-1 had become weak enough that certificates signed with it could be forged, which is why browsers were withdrawing trust in them. Here's more context: https://security.googleblog.com/2014/09/gradually-sunsetting-sha-1.html
Remediation: Ensure thorough regression testing and get a secure updated certificate issued. - Problem: The email sent to "Henry Hunnypot" (my phishing pseudonym, I know what you're thinking...subtle right?) was sent by messagelabs.com unencrypted (as their server does not support encrypted sending of email using TLS).
Risk: The email could have been intercepted and or altered. For example a malicious link or attachment could have been injected, links could have been altered, or information could have been obtained that could be used in other attacks.
Remediation: Enable TLS email encryption on all email systems used to send email by your organisation (and ensure 3rd parties have too). See here for more info. - Problem: There was a gap in governance or oversight of the new service.
Risk: Mistakes like this can damage an organisation's reputation as a trusted site, or worse compromise a user's information - perhaps leading to identity theft.
Remediation: This is perhaps the trickiest and most expensive to solve. A new process such as this should have had a once over by a security professional who would have flagged at least some of these issues. I do sympathise with organisations who struggle with the expense of this. If it really can't be budgeted it is still essential your technical staff are familiar with policies and best practice, and carry out some level of threat modelling. It doesn't need to cost much, and can be learnt for free by capable sys admins, developers, and architects. Likewise they should all be familiar with the OWASP TOP 10 Web Application Security Vulnerabilities and the IEEE Top 10 design flaws. The main thing is ensuring everyone knows it should be done, that it's a priority, and it's scheduled as a non-negotiable non-functional requirement.
Perhaps it's time the government started digitally signing all electronic communications including SMS and emails. If anyone could spearhead and champion this it's the government; though it would require extensions to the SMS standard - Google and Apple both have forward thinking approaches to security so would likely collaborate. The DNS Sender Id framework could be extended to include public keys of authorised senders - this might even be easier to maintain than the current IP address based system, or the information could be encoded into sites HTTPS certificates. This would allow mail clients to say categorically "This is an official email from passport.service.gov.uk". Extend this to other official and corporate emails and we would make spotting phishing much easier! Anyone know how to get that off the ground?
Now the good news, and most important, I was assured I can get my passport renewed quicker and easier. But more seriously HMPO demonstrated that they take security seriously and understand they must be the model of good practice, they are open and honest when there are issues. They made time to discuss my concerns at the highest levels at short notice, and I am confident that these issues will be addressed. Further I got the impression that they will learn longer-term lessons from this helping everyone stay secure online in the future.
Please share and spread the word. Let's try and make sure our (and other) organisations don't make these same mistakes.
Care must be taken in the transition to digital services.
Cheers
Andy