TalkTalk Hack Revisted

Now the dust has settled from the TalkTalk hack, what can be learnt to help other companies prevent a similar situation?

The impact of the hack on TalkTalk was rapid and dramatic; in one day its share price fell by 12% and in total an estimated £360 million was wiped off it’s value (stock value pictured). The direct one-off cost of dealing with the hack was reportedly more than £30 million.

A number of the alleged hackers have been arrested and it appears that rather than organised criminals or nation-state actors this hack was perpetrated by a group of teenagers ranging in age from 15 to 20.
 
Without belittling the skill of the teenagers, it is safe to say that of "threat actors" that concern corporations and governments, mischievous teenagers should sit somewhere near the bottom of the risk scale. The fact they appear to have been caught shows their lower level of expertise, and sets this hack apart from other notable cyber intrusions; such as Sony where it is still hotly debated who did it, let alone whether they will be brought to justice. Despite this, the hack showed just how much damage even a relatively unsophisticated group of hackers can still have on a company.

The publicity surrounding the hack was bad for TalkTalk’s share price, but at least TalkTalk identified they had been breached at all. One study found that in 2014 it took up to 205 days for most companies to discover a breach.

The same study also found that typically it takes hackers seconds to breach a system and only minutes to exfiltrate the data they are interested in. More often than not the public never knows about the many cyber intrusions that occur, making understanding the scale of the problem even more difficult.

In the Talktalk case the attackers reportedly used a simple vulnerability in the company website to launch what is known as a blind SQL injection attack; a way of querying and breaching the database sitting behind a website. This should not have been a difficult vulnerability to identify and fix. This was made worse by bad security procedures by TalkTalk; the creditials for one admin were found to be username: tim, password: tim.

The Teenagers in question are unlikely to have had a wider strategy for using, passing-on and profiting from the information they stole, which would undoubtedly already happened if the hack was carried out by an organised criminal group. A number of the hackers involved have already stated that it was actually done for “shits and giggles”.

This should give TalkTalk’s shareholders something to be happy about and the impact on customers and the data stolen is likely to be much lower than first suspected. In general the more public the hack, the easier it is to find what information has been stolen and easier to mitigate against any disclosure.

Suffering three public hacks in the space of a year makes it clear that TalkTalk is doing something wrong when it comes to cyber security. The latest hack was not a complex or difficult problem to fix and should have been identified if the company was employing ethical hackers and penetration testers.

There are extensive lists of procedures that can be put in place to increase cyber security, all which take money and staff. Ethical hacking is usually at the very end of most lists, and as one of the most expensive to be implemented it is often not done, this is a problem because it is potentially the most important to carry out. Without skilled professionals testing a network and system just like the real hackers would there is no way of knowing what holes there are left in your security infrastructure.

As Talktalk found the money spent trying to mitigate a cyber attack is vastly more than putting in effective procedures before it happens. The irony is that even if millions are spent on the highest level of cyber security it still does not guarantee that all attacks will be stopped. A good cyber security infrastructure will stop many attacks, including the one Talktalk was victim to but sadly complete security can never be guaranteed. Knowing this and preparing for what to do when breach does occur is another useful part of a complete cyber security strategy.

Max Vetter is a consultant, trainer, investigator and ethical hacker specialising in Cyber Security and the Dark Web

http://maxrvetter.com/

« Islamic State Launches A Cyber War Magazine
Ukrainian Power Grid Hack »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Zentek Digital Investigations

Zentek Digital Investigations

Zentek has been providing digital forensics services to the public and private sector for computers and mobile devices since 2004.

Cloudmark

Cloudmark

Cloudmark is a trusted leader in intelligent threat protection against known and future attacks, safeguarding 12 percent of the world’s inboxes from wide-scale and targeted email threats.

Sepio Cyber

Sepio Cyber

Sepio is the leading asset risk management platform that operates on asset existence rather than activity.

Ethoca

Ethoca

Ethoca is a secure network for card issuers and merchants to connect and work cooperatively outside the payment network in a unique and powerful way.

Nullcon

Nullcon

Nullcon provides an integrated platform for exchanging information on the latest attack vectors, zero-day vulnerabilities and unknown threats.

Elemendar

Elemendar

Elemendar Artificial Intelligence reads cyber threat reports written by humans and translates them into industry-standard, machine-readable and machine-actionable data.

Farsight Security

Farsight Security

Farsight Security provides the world’s largest real-time actionable threat intelligence on how the Internet is changing.

Elysium Analytics

Elysium Analytics

Elysium Cognitive Security Analytics delivers the latest and most flexible security system to reduce cost and complexity while providing unmatched scalability.

LogicHub

LogicHub

LogicHub is built on the principle that every decision process for threat detection and response can and should be automated.

OwnBackup

OwnBackup

OwnBackup proactively prevents you from losing mission-critical data and metadata with automated backups and rapid, stress-free recovery.

Asimily

Asimily

Asimily’s IoMT risk remediation platform holistically secures the mission-critical healthcare devices that deliver safe and reliable care.

AutoSec

AutoSec

AutoSec supports the FFI program Electronics, Software and Communication by dissemination and exploitation of the results of projects related to automotive cybersecurity.

Winmill Software

Winmill Software

Winmill is a technology services company that provides expert consulting services in Application Development, Application Security and Cyber Security.

DigitalWell

DigitalWell

DigitalWell provide fully managed IT and communications solutions for a truly innovative end-to-end experience - for your customers and teams.

Troye Computer Systems

Troye Computer Systems

Troye provide a complete range of digital workspace solutions that empower people to do their very best work in a safe and secure manner anywhere, anytime, using any device.

Identifly

Identifly

Identifly is the leading Australian independent identity consultancy and partner in Australia, helping enterprises implement large scale identity security projects fast.