0

Protecting Privileged Accounts can be the Difference Between “Managing” and “Securing” File Transfers

Posted on January 10, 2013 by Oded Valin

In the digital world in which we live, securing file transfers is critically important to personal and corporate security. Every day we send and receive sensitive information with the expectation that the services we use help us keep it secure.

But, as we re-learn constantly, vendors calling themselves ‘secure’ doesn’t always make it so. The latest egregious example is found in a high profile vulnerability discovered in a managed file transfer service used internally by Facebook employees:
http://yro.slashdot.org/story/13/01/08/1949210/serious-password-reset-hole-in-accellion-secure-ftp

In short, the vulnerability allowed an attacker to create a new user account, log in with that new account and change the password of another user, even if that other user had full administrative privileges. After that, a would-be attacker has a clear shot at any of the data in the file transfer application. Ouch!

Unfortunately, that’s what can happen when security is added as an afterthought and is not a core design principal built into the product from the ground up.

Given that Cyber-Ark’s business is all about privileged accounts and securing critical data from advanced attacks, we do know something about this. If you are looking at a truly secure file transfer service that won’t put your critical data at grave risk, here are some things you need to look for.

  1. The process used to create new users should not rely on public, generic URLs, but have a full set of security controls and optional secure workflows in place.
  2. The entire password resent process should work in a secure way:
    • It shouldn’t rely only on a HTTP POST request without asking for the user’s current password or using a unique link.
    • It shouldn’t transfer confidential parameters in a POST request without encrypting it with something stronger than BASE64.
    • The reset function should use a unique link with an expiration period, not a public, generic and insecure link.
    • It should offer the option of adding personal security question challenges to the process.
  3. Session management should be done in a secure way using a unique session ID and unique tokens. It cannot be part of the URL.
  4. Executable code should be obfuscated
  5.  The file repository should be fully encrypted and separated from the web application server in case the web portal is attacked.
  6. Follow the National Institute of Standards and Technology (NIST) guidance and “require your vendor to demonstrate that their software development processes employ state-of-the-practice software and security engineering methods, quality control processes and validation techniques”.

This sounds basic – but it’s part of the due diligence that every business should do to truly understand the level of security that has been built into the product. Just because a vendor claims to offer “secure” file transfer or cloud sharing, doesn’t make it so.

If security really matters to you, (and it should,) your best bet would be to start with a company with a “security first” approach, and the credentials to back it up.

0

Was your car stolen? Blame an unprotected privileged account

Posted on January 8, 2013 by John Worrall

We’ve often referred to privileged accounts as the “Keys to the Kingdom” given the wide ranging access they provide.  But are privileged accounts the “Key” to your car as well?  Maybe, if you drive a BMW.    Nick Barron posted an article in SC Magazine UK this week demonstrating why this may be the case:  BMWs: Gone in 60 keystrokes – SC Magazine UK.

For BMWs new “keyless” cars, there is an administrative function that allows mechanics to service and repair the car.  It also provides them access to the information needed to initialize a new key.  Seems odd, but so far, it’s not a real problem.  Unless, of course, that same function is available to anyone, and not just to your trusted garage mechanic.  To make matters worse, the car alarm couldn’t detect the tampering.  Car thieves have a clear shot.

This is a perfect example of what commercial and government organizations face with their IT-based resources.  Certain “privileged accounts” are built into nearly every IT product to allow authorized administrators to service and repair the systems.  Used properly, and by trusted, authorized people, they present no problem.  But of course, in malicious or careless hands, these accounts can cause catastrophic damage.

Best practices are emerging around a three-stage approach to managing these potential vulnerabilities.   First, protect the credentials to these accounts, so only authorized users can access them. Next, add accountability.  Ensure that every time a privileged account is used, you know who the specific user is, what they did with the account and why they did it. Finally, provide real-time intelligence on how these account are being used so that any potential misuse can be addressed immediately, and not after the damage is done.

Using the BMW example for the purpose of illustration, here’s how it might play out if proper privileged account controls are in place.  First, access to the administrative function would be limited to authorized personnel only.  Every action taken using the account should be recorded, with the owner being able to review exactly what work was done, which mechanic did it and why.  And of course, a real-time alert on the car owner’s smart phone telling them that the key was cloned would be very helpful in trying to catch the thief before they drove away with the $60,000 car.

I realize I’m ignoring many realities of cars and mechanics, of which I know very little.  But it’s a great way to think about the privileged account problem in our IT infrastructure.  Protection. Accountability. Intelligence.

0

IT Security Rewind: The Continued Rise of Privileged Attacks (our eBook Preview Edition)

Posted on April 23, 2012 by Josh Arrington

As part of this week’s IT Security Rewind, we have decided to take a deeper examination into recent massive data breaches to demonstrate how attackers continue to exploit administrative and privileged accounts to conduct their system-wide damage. We’ll also preview our soon to be released eBook, which covers similar ground through an even more historical examination and discussion of solutions to effectively manage, secure and mitigate the threats associated with privileged credentials.

Data Breaches Gone Wild

First, let’s take a look at some recent attacks that have forced IT insiders and stakeholders to reevaluate their proactive approaches to security and access control:

  • Last December, the U.S. Chamber of Commerce confirmed that compromised administrator accounts led to an attack by Chinese hackers. The breach compromised the information of the Chamber’s 3 million members.
  • In March of this year, a Global Payments breach exposed financial data belonging to 1.5 million uses of Visa and Mastercard. Analyst firm Gartner has claimed the attack resulted from a weak authentication mechanism that enabled access to an administrative account.
  • Most recently, this month, attackers were able to exploit health records stored by the Utah Department of Technology Services by cracking a “weak” default administrative password. Once inside, the servers, and the data housed there, were compromised.

The Privileged Pathway

In all three of these well-publicized cases, hackers were able to bypass perimeter security controls to gain access to target systems through the same poorly protected and wide-open gateway: privileged and administrative accounts. In each case, once inside, attackers leveraged the privileged account to gain access to additional servers, databases and other high-value systems that only a select few people are actually granted permission to access.  The result, as demonstrated by the above, is easy access to millions of sensitive records.

Unfortunately these accounts have emerged as a primary target for hackers because infiltration is possible through rather simple means—an easy-to-crack password, spear-phishing or exploitable zero-day vulnerability.  In the Utah case, it was a weak password that was supposed to protect a very sensitive privileged access point on a server that caused the breach.

 

The Problem with Sharing

The problem that continues to persist is that privileged accounts are often shared with passwords that are rarely changed.  This remains the great paradox in the world of identity and access management and security in general—while attackers are targeting these incredibly sensitive access points, personal passwords to websites such as Facebook have even higher standards of security and strength.

These vulnerabilities are not limited to a specific industry – we see it across the spectrum.  In fact, this is very similar to the weaknesses and vulnerabilities at the Bonneville Power Administration highlighted by the Energy Department.  Auditors uncovered 11 servers configured with weak passwords – including one that hosted an administrative account with a default password.

While troubling, reports of this nature are commonplace and are a contributing reason as to why we continually see massive breaches of this nature in the headlines.

Cyber Attacks and Privilege: Stay Tuned for More

For Cyber-Ark, these trends and developments are startling but not novel. Next week, we’ll be releasing a new eBook—“Don’t Give Cyber Attackers the Privilege–focused specifically on the proliferation of cyber attacks targeting unmanaged privileged accounts. The report outlines a history of this abuse dating back to January 2010 through a compilation of privileged-related attacks. The eBook also outlines the steps required to control these access points through privileged identity management.

0

IT Security Rewind: The Week of March 12

Posted on March 19, 2012 by Josh Arrington

With several major security shows like the U.S. RSA Conference 2012 and Black Hat Europe behind us, and several more in the queue, the industry is tireless when it comes to elevating awareness around the evolving threat landscape.  And it has to be, as it seems hackers never ease up in their relentless pursuit of vulnerabilities to exploit. With that said, let’s take a look at some topics that are generating buzz in IT security. We’ll dub this our IT Security Rewind: March Madness Edition!

No Longer Privileged: Employee turnover is a cost of doing business, but what happens when an employee with privileged user account access (e.g. a sys-admin) leaves the company? Apparently not enough. An IT Director piece examines the propensity of organizations to ineffectively close out the user accounts of inactive sys-admins. Fortunately, proactive removal and monitoring of privileged accounts is a central tenet of effective privileged identity management best practices. Organizations should avoid risks by deploying solutions that grant privileges on an ‘as needed’ basis.

APT? What’s in a name? The pursuance of a precise definition continues to perplex the IT security community and this week CSO took a stab at truly defining the term through an in-depth feature. The article focuses on the basic components of an APT, the normal actors involved, and some common attack vectors. One glaring omission: The piece does not address the privileged escalation angle that is commonly associated with most APTs.

Password: You are the Weakest Link. Goodbye: Joe McKendrick of ZDNet compiled an insightful follow-up post to the results of the Trustwave 2012 Global Security Report which highlights how poor IT password management persists as the largest security concern facing most organizations. The report indicates that “the use of weak and/or default credentials continues to be one of the primary weaknesses exploited by attackers for internal propagation.” As McKendrick describes, the use of default (and hardcoded) passwords, in particular, creates system-wide vulnerabilities that enable hackers to attack with limited sophistication.

That’s it for this week—what else is making you “mad” about IT security?

0

Cyber-Ark Introduces Version 7 of its Privileged Identity & Privileged Session Management Solutions

Posted on March 5, 2012 by Josh Arrington

Cyber-Ark explains how it is helping enterprises meet today’s advanced security challenges and highlights the new capabilities, offered in its largest release to date, further extending its long standing market leadership. By focusing on continuously protecting the datacenter, learn how Cyber-Ark creates powerful solutions that fight internal and advanced threats and satisfy the growing demands of compliance.

0

IT Security Rewind – Week of February 13, 2012

Posted on February 22, 2012 by Josh Arrington

rewind

This week’s IT security news coverage was shaped largely by the fall-out associated with Nortel’s 10 year data breach, which has now been attributed by some as one of the primary factors impacting the company’s ultimate downfall,  some speculating that competitors were able to gain access to sensitive IP over the course of a decade.  Here are several stories we think offer the best perspectives on the breach.

  • History of a Decade-Long Hack: According to the Wall St. Journal, using seven passwords stolen from top Nortel executives, hackers penetrated Nortel’s computers, repeatedly downloading technical papers, R&D reports, business plans, employee emails and other documents.  From our standpoint, this is another high-profile example of the need to better manage and control privileged access.  With relative ease, it appears the hackers were able to use the passwords to access the network, then, once inside, elevate privileges in order to access sensitive data and information.  From an industry standpoint, Nortel’s ‘inaction’ is inexcusable.
  • Expect Defenses to Fail: So what can we learn from all this? Information Week published a piece that took a first crack at some answers, “8 Lessons From Nortel’s 10-Year Security Breach.”  Some quick take-a-ways?  Expect defenses to fail, conduct a thorough forensic analysis and expect greater accountability.
  • An Empowering Cybersecurity Bill?: In other news, called “critical” in order to avoid our country suffering a “catastrophic attack,” a bipartisan group of senators introduced long-awaited cybersecurity legislation. According to CSO, this is a comprehensive bill that would encourage the sharing of information about threats and attacks between government and industry.  Specifically, the Cybersecurity Act of 2012 would give the Department of Homeland Security power to regulate the kind of company security protections government deems necessary to protect critical infrastructure — such as power and phone companies, water and treatment plants, wireless providers and other companies based on DHS risk assessments.

We’d like to hear your thoughts.  What lessons do you think we can learn from Nortel?  What are your hopes for outcomes from the Cybersecurity Act?

0

IT Security Rewind – Week of January 30, 2012

Posted on February 6, 2012 by Josh Arrington

At Cyber-Ark we don’t typically like to brag about our achievements, but we have had such a great week that we can’t help but show off a bit. This year we have been shortlisted for not one, not two, not even three but FOUR SC Magazine Europe Awards! We are very excited and wanted to send our congratulations to all of the finalists that were also shortlisted in the Best IAM Solution, Best Remote Access, Best Security Management and Information Security Product of the Year Categories. While we’ve been celebrating we’ve also been paying close attention to some evolving stories in cyber legislation as well as an interesting twist on a phone hacking and wanted to put stories out there to get our readers’ opinions:

  • Bloomberg Businessweek reported that the Cyber-Security bill has been delayed in reaching a vote on the Senate floor.  The Senate bill would authorize the Homeland Security Department to identify infrastructure that’s “considered critical to U.S. economic and national security” and develop standards that must be met to protect them. Understanding the security threat that cyber war poses on our nation and the number of sophisticated hackers out there, advisors are doing their best educate the Senate on the urgency behind this bill. Bruce McConnell, a counselor to Napolitano on cyber security matters stated, “What we were here today to do was make sure the Senate understands the severity and importance of the threats that we’re facing and the need for action.”

 

  • Trying to hide your organization’s data breach? VeriSign proved this week that you can actually get away with it. After scouring 2,000 SEC filings Reuters reported this week that VeriSign was actually hit by hackers back in 2010 but did not report the breach until their SEC filing in October of 2011. How is this possible when the company states that “more than half (56%) of the world’s DNS hosts rely on the VeriSign .net and .com infrastructure”? Well, as long as credit card data isn’t involved organizations actually aren’t forced by the government to reveal a breach to the public.

 

  • Finally, FOX News and other outlets reported that a phone call between the FBI and Scotland Yard was recorded and released online by the hackers in Anonymous. Luckily, the FBI said that there was no classified information on the call, but it was still accessed illegally. Anonymous tweeted that they were able to hack the phone call by compromising an investigator’s emails. If the call is authentic, it is quite jarring that the group was able to hack into the very call that discussed proceedings for past offenses.

 

We’d love to get your thoughts on these legislative issues as well as the phone hacking – do you think the Senate is taking the threat of cyber war seriously? Should VeriSign have been forced by law to reveal that they were breached? Is Anonymous a bigger threat than we anticipated?

 

Let us know in the comments!

0

IT Security Rewind – Week of January 9

Posted on January 13, 2012 by Josh Arrington

It’s time for the first IT Security Rewind of 2012. While 2011 was certainly shaped by several spectacular security breaches, if the beginning of 2012 is any indication, then we are in for another wild ride.

NoSQL is No Small Problem: Dark Reading shines some “light” on a serious vulnerability to track in 2012—the security flaws of database technology NoSQL.  The article highlights that as with many traditional database technologies, the proactive management of privileged identities is a critical component to ensuring an effective security posture within these systems.

SCADA Issues Persist: There’s no lack of examples when it comes to highlighting the prevalence of vulnerabilities that exist in SCADA Systems.  As Sara Yin of Wired highlights through coverage of a recent presentation by Blake Cornell, an independent security researcher, default passwords have played a significant role in recent incidents, including the Siemens breach.  Again, it’s increasingly evident that using advanced privileged identity management technology can be part of an effective solution for managing these risky passwords that can be manipulated to gain wide-scale system access and control.

Consumerization of IT Risk: Consumerization of IT has carried over a hot topic for the security industry —is it 2012’s “cloud”-like buzz word? More importantly, what types of security risks does this trend pose? As reported in NetworkWorld, a survey of 520 CIOs found that 77% said they worry that “further consumerization of IT will lead to greatly increased business risks.” As enterprise technology continues to “go mobile”—this will be an important development to track, especially as individuals use mobile devices, such as phones and tablets, to share and exchange sensitive information.

So, 2012 begins. Let us know your predictions on the biggest security topics to watch for this year.

0

Cyber-Ark Predicts: What’s Next on the Privileged Horizon

Posted on December 15, 2011 by Andrey Dulkin

Over the past year we’ve witnessed several spectacular attacks that demonstrated just how dangerous cyber criminals have become.  These attacks have emphasized that a narrow focus on protecting against the insider threat is short-sighted and that more preventative approaches are needed to guard against external, highly targeted and persistent attacks that focus on high value information such as customer data and intellectual property.  In taking stock of the threat landscape and emerging IT trends, we’ve summarized three key areas that we think will evolve significantly in the coming year, both in terms of technology innovation and risk.

Targeted Attacks: Preventative Protection on the Rise

As an industry, we’ve seen attacks move from opportunistic to increasingly sophisticated and targeted (think Stuxnet), with privileged access rights as a consistently – and perhaps increasingly – popular attack vector. Privileged accounts have proven to be a ‘sweet spot’ for attackers because of the broad, often anonymous access they provide to high value targets.  However, many organizations are still in the early stages of identifying and solving privileged account weaknesses, including those caused by hard-coded passwords, which provides attackers with an extended window of opportunity.

That said, in the coming year we strongly believe that there will be a rise in more preventative approaches to protecting privileged accounts, including better isolation, access control and activity recording. This is due in part to greater awareness, increasing regulations and adoption of best practices, which are all driving significant growth for the privileged identity management market as a whole, and ultimately will help drive down the popularity of privileged accounts as an attack mechanism.

As strong indicators for the increasing need for more proactive privileged account management, consider that as a result of the changing threat landscape that the SANS Institute announced a major update to its 20 Critical Controls earlier this year.  The 20 Critical Controls is a prioritized baseline of information security measures designed to provide continuous monitoring to better protect government and commercial computers and networks from cyber attacks.  Several are directly related to privileged accounts: #8 Controlled Use of Administrative Privileges; #9 Controlled Access Based on the Need to Know and #11 Account Monitoring and Control.

Similarly, in the most recent NIST 800-53 publication that provides the recommended security controls for federal information systems and organizations, there is an emphasis establishing a proactive, preventative approach to privileged account management to achieve FISMA compliance.

SCADA Systems Under Attack: Vulnerabilities Continue to Put Critical Infrastructure at Risk

From weapons systems and water pumps to prison gates, systems not previously considered vulnerable to attack showed up in news headlines over past year.  Those attacks have generated visibility for the fact that many of those systems were not designed with security in mind. Because of the hard-coded or weak/rarely changed passwords in tools like programmable logic controllers or SCADA software, those targets have become accessible to attackers, potentially putting critical infrastructure at risk.

With repeated attacks on the horizon, and building awareness, we expect that in 2012 there will be a notable increase in research dedicated to examining how hardware can be attacked by software, and the use of code to execute attacks particularly in the energy and utilities space.  One early indicator that more research and solutions are needed may be statements made earlier this year by the U.S. Department of Homeland Security that said it was reevaluating whether it makes sense to warn the public about all of the security failings of industrial control system (ICS) and SCADA software – considering re-categorizing design flaws vs. security holes.

One of the main challenges with SCADA systems is that even when knowing about specific vulnerabilities, the cycles to fix them are so slow that it often makes more sense to try and keep the vulnerability confidential so attackers won’t exploit it during the lengthy repair period (remember “security by obscurity,” this of course will not be a long term strategy).

Private Clouds: Hypervisor Weaknesses Exposed

While some hesitancies around public cloud infrastructure may still exist, infrastructure changes resulting from rapid private cloud adoption could result in new risks, the scope of which we may not be fully aware of, yet, organizations will be expected to proactively protect against.  For example, in a private cloud scenario, a virtual machine can sit on multiple servers or be accessible through multiple hosting centers.  A systems administrator may know the virtual machine is accessible, but it’s difficult to know who has access to it, when it was accessed, or what was done once access was achieved.  The hypervisor provides some of that much-needed control, but at the same time becomes an attractive target for attack.  In 2012, protecting against hypervisor threats will quickly become an IT security priority, and, as we achieve greater maturity in the virtualization space, we could potentially see the cost efficiencies of virtualization take a second seat behind increased risk.  We will also see IT security teams taking a more significant role in the initial build-out and deployment of private clouds to initiate much-needed proactive security infrastructure.

What are your thoughts on these 2012 trends to watch? Do you have some of your own to share?

0

IT Security Rewind – Week of November 28

Posted on December 5, 2011 by Josh Arrington

rewind

Returning from a holiday break is never easy, so if you were slightly neglectful to your industry news this week don’t fret – we’ve got it covered. It may have been a week of turkey hangovers for some of us, but the IT industry was busy reporting end-of-year recaps, forecasts for 2012 and of course, breaking news: Here is our summary of this week’s hottest stories.

Looking to achieve a life of “privilege” as an IT security pro? InformationWeek posted its annual “Best Paying IT Security Jobs In 2012” article and guess what? Security professionals can expect salaries to increase by an average of 4.5% in 2012—not bad in such a tumultuous economy. If you are a security professional in a midlevel/ senior role you are in a great position as demand is high. Supply, however, remains a different matter. Robert Half Technology said it expects to see “an abundance of positions and a shortage of skilled candidates.” As expected, the article also reported demand would soon increase for people who could manage “privileged identity management.”

Cyber crime linked to terrorism – In far more serious news, the FBI has revealed that four hackers were arrested in the Philippines last week in connection with an organized attack on the clients of U.S. telecommunications giant AT&T. Law enforcement officials believe the suspects were employed by the terrorist group Jemaah Islamiyah, which has been linked to numerous bombing attacks. According to Reuters, the FBI claims that AT&T’s customers were the targets of the hackers and were not the carriers themselves. An anonymous source reportedly added that the hackers breached the phone systems of AT&T customers and made calls to expensive international premium-rate services.

Water-pump hack pumped with errors – The SCADA hack that resulted in a water pump being destroyed has proven to be false – Wired reported this week that a contractor who was supposed to work on the system logged in according to permissions during a vacation trip to Russia, which was misconstrued as an outside hack.  In truth, the water pump simply burned out, as pumps are wont to do, and a government-funded intelligence center incorrectly linked the failure to an internet connection from a Russian IP address months earlier.

That about wraps it up for this week – we’d love to hear your thoughts on this week’s happenings – leave your comments here…

Returning from a holiday break is never easy, so if you were slightly neglectful to your industry news this week don’t fret – we’ve got it covered. It may have been a week of turkey hangovers for some of us, but the IT industry was busy reporting end-of-year recaps, forecasts for 2012 and of course, breaking news: Here is our summary of this week’s hottest stories.

Looking to achieve a life of “privilege” as an IT security pro? InformationWeek posted its annual “Best Paying IT Security Jobs In 2012” article and guess what? Security professionals can expect salaries to increase by an average of 4.5% in 2012—not bad in such a tumultuous economy. If you are a security professional in a midlevel/ senior role you are in a great position as demand is high. Supply, however, remains a different matter. Robert Half Technology said it expects to see “an abundance of positions and a shortage of skilled candidates.” As expected, the article also reported demand would soon increase for people who could manage “privileged identity management.”

Cyber crime linked to terrorism – In far more serious news, the FBI has revealed that four hackers were arrested in the Philippines last week in connection with an organized attack on the clients of U.S. telecommunications giant AT&T. Law enforcement officials believe the suspects were employed by the terrorist group Jemaah Islamiyah, which has been linked to numerous bombing attacks. According to Reuters, the FBI claims that AT&T’s customers were the targets of the hackers and were not the carriers themselves. An anonymous source reportedly added that the hackers breached the phone systems of AT&T customers and made calls to expensive international premium-rate

Returning from a holiday break is never easy, so if you were slightly neglectful to your industry news this week don’t fret – we’ve got it covered. It may have been a week of turkey hangovers for some of us, but the IT industry was busy reporting end-of-year recaps, forecasts for 2012 and of course, breaking news: Here is our summary of this week’s hottest stories.

Looking to achieve a life of “privilege” as an IT security pro? InformationWeek posted its annual “Best Paying IT Security Jobs In 2012” article and guess what? Security professionals can expect salaries to increase by an average of 4.5% in 2012—not bad in such a tumultuous economy. If you are a security professional in a midlevel/ senior role you are in a great position as demand is high. Supply, however, remains a different matter. Robert Half Technology said it expects to see “an abundance of positions and a shortage of skilled candidates.” As expected, the article also reported demand would soon increase for people who could manage “privileged identity management.”

Cyber crime linked to terrorism – In far more serious news, the FBI has revealed that four hackers were arrested in the Philippines last week in connection with an organized attack on the clients of U.S. telecommunications giant AT&T. Law enforcement officials believe the suspects were employed by the terrorist group Jemaah Islamiyah, which has been linked to numerous bombing attacks. According to Reuters, the FBI claims that AT&T’s customers were the targets of the hackers and were not the carriers themselves. An anonymous source reportedly added that the hackers breached the phone systems of AT&T customers and made calls to expensive international premium-rate services.

Water-pump hack pumped with errors – The SCADA hack that resulted in a water pump being destroyed has proven to be false – Wired reported this week that a contractor who was supposed to work on the system logged in according to permissions during a vacation trip to Russia, which was misconstrued as an outside hack.  In truth, the water pump simply burned out, as pumps are wont to do, and a government-funded intelligence center incorrectly linked the failure to an internet connection from a Russian IP address months earlier.

That about wraps it up for this week – we’d love to hear your thoughts on this week’s happenings – leave your comments here…

services.

Water-pump hack pumped with errors – The SCADA hack that resulted in a water pump being destroyed has proven to be false – Wired reported this week that a contractor who was supposed to work on the system logged in according to permissions during a vacation trip to Russia, which was misconstrued as an outside hack. In truth, the water pump simply burned out, as pumps are wont to do, and a government-funded intelligence center incorrectly linked the failure to an internet connection from a Russian IP address months earlier.

That about wraps it up for this week – we’d love to hear your thoughts on this week’s happenings – leave your comments here…

Pages ... 1 2 3 4 5