Information Security Data Breach

Question: Discuss about the Information Securityfor Data Breach. Answer: Background Data breach is referred to as the incident in which the confidential and sensitive information might get stolen from the data server by unauthorized person unethically without permission. As the technology is growing up the concept of hacking is also becoming devastating. Nowadays data theft has become one of the most challenging phases in technology. Among the recent data breaches roundup, in September 2015, security and data breaches occurred in Apple centre, which become a headline (Data-breaches, 2015). After detail analysis, it has been found that for creating free application Utopia, iOS malware named as Key-raider, stole around 225,000 apple accounts. The suspicious Apple iOS tweak was analyzed by Weip Tech and it has been reported that, more than 225,000 valid apple accounts along with their password are stored on the apple server. The aim of the attack is to develop two iOS jailbreaks tweaks for downloading different applications from the official application store of Apple (Wang et al., 2013). Without proper payment, the attackers wanted to utilize the applications efficiently. The jailbreak tweak software packages are used by the attackers because it allows them to perform the required actions that are not generally possible in iOS. In the command and control serer of the malware attackers the stolen information were used to stored and utilized on required time phase. About the Problem Scenario The incident of malware attack in the iOS app store took place in the year of 2015, September. All Apple users have apple accounts and their registered id and passwords are stored in the app server (Sun, Akiyama Mori, 2016). The keyrider software package rather malware, attacked on the apple server and hacked all confidential information including thousands of certificates, private keys, purchase receipt etc. The stolen data were stored in C2 server that contains threat itself to expose the information of the users. In order to unlock the functionalities and operations of the iphones and ipads, the Key-raider malware stole apple push notification service (Shahriar, Klintic Clincy, 2015). The two tweaks were capable to hack the app purchase requests and to steal the purchase receipt from the C2 server. The Reason Behind its Occurrence The main reason behind this attack is to theft the sensitive information of the users without informing them and to utilize those data for different unethical purposes. Initially apple store was found to be one of the most secured servers where, the external users were not able to attack easily (Jang et al., 214). Thus, the official information of the users were enough secured from the external attackers. In order to hijack the official information from the data server the key-raider malware was used by the attackers. In addition to this, the attackers actually used this malware to assault directly the app store and without paying accurate payment they wanted to use the application of Apple. After this the attackers will be able to perform those tasks also which are not actually possible to be performed on the OS platform. The tweaks had downloaded over 20,000 times, which stated, that more than 20,000 users are abusing 225,000 stolen data from the app store (Stankovic, 2014). Initia lly it was very difficult for the owners to identify the actual reason and process of attack but gradually, after conducting vast investigation, i_82 discovered the key-raider malware attack appropriately. Possible Solution to Mitigate the Occurred Issue Different strategies are there, used by the software and hardware analysts to protect their data server from the external attacks. If proper strategies are used, then only the owners will be able to keep their server data secured. Based on the type of information and vulnerabilities, appropriate mitigation strategies are needed to be adapted (Xing et al., 215). The possible solutions against the malware attacks are as follows: Data encryption: In order to keep the data secured from the key-raiders malware, proper encryption algorithm is required to be adapted by the data server. In this process the sender and receiver both are bound to use symmetric and asymmetric keys according to the background of the situation. After the application of proper encryption algorithm none of the external users will be able to get the details of the public and private keys. Due to the disruptive services the nature of malicious code as been actively shifted. Antivirus adaptation: Another important technique that can be used to keep the information secured from the attackers is adaptation of antivirus. Depending on the nature of the data the anti viruses should be installed. Authentication: Authentication is referred to as another important component that is strictly required to be considered to maintain the data security. With the help of authentication only the authorized users will be able to visit the app stores whenever required. The non-registered users or the unauthorized users are not competent to hijack the information from the app server. Firewall implementation: In order to keep the data secured and to reduce the number of attackers, application firewall is also required to be configured. Introduction In the year of 2015, icloud hacking is found to be as one of the biggest controversial hacking cases. Though, the incident took place in the summer 2014, but officially it was exploited in the year of 2015 (Hacking Cases, 2015). The victim of the attack was number of celebrities. It has been found that, in 2014, dozens of icloud of the celebrities were mainly attacked by the external attackers. In order to hijack, the photos of the celebrities mainly the attackers attacked the cloud server. This is referred to as one of the popular hacking cases that occurred between 2012 and 2016. The report depicts the background scenario of this incident including the victim and the attackers of the incident. It also elaborates the way through which the attack incident carried out (Choo, 2014). In addition Ito this, lastly it will illustrate different prevention technologies that are needed to be adapted by the owners to protect the photos of the celebrities from the attackers. Overall Problem Scenario This scenario took place in the year of 2014 summer but is officially reported in 2015. After investigating incident, it has been determined that, more than 500 private images of the celebrities from different domain are hijacked by the attackers. Most of the victims of the incident are women though many men are also found to be victim of the attack. After hijacking the images the attackers posted those in different social networks and other websites. From the security investigation it has been determined that the images are retrieved from the apple cloud named as icloud (Braunstein, 2016). The attack become easier for the attackers because the cloud server allows the users to make multiple attempts for guessing the password. Due to the allowance for unlimited times password guessing options on the Application Programming Interfaces (API), the icloud access became easier. The attackers need not to take any permission from the users rather the chance of redundancy also enhances rapidl y. The Problem scenario The images hijacked from the cloud storage were obtained by the attackers from the online storage that has been offered by the Apple Icloud (Hacking Cases, 2015). The cloud storage automatically stores the images of the celebrities and also keeps the backup of the images in the storage. The attackers targeted on the icloud account in terms of account identity and passwords directly. The attacks are phishing and brute force attacks (Elhai et al., 2017). Due to lack of security in the cloud storage the photos are hacked by the attackers. The apple privacy security was questioned due to lack of security. Even before public release the photos were getting revealed in front of everyone. The main activity center of the phishing attack was the link sharing website Reddit. Moreover, the critics realized that distribution of the images publically is one of the major privacy invasions. Not only images but also the private information was also hijacked by the external attackers. The Affected Person or Victim After analyzing the incident it has been found that the victims of the attack are the celebrities Most of the celebrities including men and women are the victims of this incident. The icloud data storage leaked the pictures of the celebrities and publically released those. The image content and the confidential information both get hijacked by the external attackers. Though some of the photographs are referred to as fake but most of the photos are stated as authenticated rather original. The external attackers attacked on the icloud service provider were the confidential data and the images both get stored. In this phishing attack the attackers get opportunity to make multiple attempts to identify the account id and password at the same time. As there was no prominent limitation of the attempt thus, the attackers too several attempts and hijacked the images. The Way through the Attack Carried Out After matching the id and password of the apple accounts it become easier for the attackers to search for the desired products (Hacking Cases, 2015). After hijacking the photos, they promoted those to the public platform where all the users will be able to look for the photographs. The Possible Attack Prevention Strategies In order to mitigate the problems, different possible strategies could be undertaken. These are as follows: Data encryption: The fundamental concept of encryption is required to be undertaken by the owners to overcome the issues. Server authentication: The server is required to be authorized, so that the unauthorized users cannot attack and hijack images from the server. Limited attempts: There should be limit for making attempts on the password verification. If it is found that user are making more than 3 attempts then, for that particular person the access should be blocked. Conclusion From the overall discussion it can be concluded that, information security is one of the major concerns of operating system and data server. If the owner fails to adapt accurate security measures, then the attackers will easily hack information from the server even without permission. By developing vast investigation on malicious activities, the computer activities can be controlled and monitored accurately. The report elaborated the incident appropriately and after analysis, the victims of the incident are also identified. In addition to this, the background of the problem scenario, the victim of the incident and the way through which the attack had carried out are also elaborated in this report. After identifying the problems, possible mitigation strategies are also elaborated in this report. Accurate mitigation approaches will help to overcome the issues. References Ahmed, M., Litchfield, A. T., Ahmed, S. (2014). A Generalized Threat Taxonomy for Cloud Computing. ACIS. Braunstein, A. (2016). Standing Up For Their Data: Recognizing the True Nature of Injuries in Data Breach Claims to Afford Plaintiffs Article III Standing.Journal of Law and Policy,24(1), 3. Choo, K. K. R. (2014). Mobile cloud storage users.IEEE Cloud Computing,1(3), 20-23. Data-breaches,.(2015).recent-data-breaches-september-2015.www.identityforce.com. Retrieved 19 September 2015, from [online] https://www.identityforce.com/blog/recent-data-breaches-september-2015 Elhai, J. D., Chai, S., Amialchuk, A., Hall, B. J. (2017). Cross-Cultural and Gender Associations with Anxiety About Electronic Data Hacking.Computers in Human Behavior. Hacking Cases,. (2015).The Most Controversial Hacking Cases of 2015.Blog.tcitechs.com. Retrieved 29 September 2015, from [online] https://blog.tcitechs.com/blog/the-most-controversial-hacking-cases-of-2015 Jang, Y., Song, C., Chung, S. P., Wang, T., Lee, W. (2014, November). A11y attacks: Exploiting accessibility in operating systems. InProceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security(pp. 103-115). ACM. Shahriar, H., Klintic, T., Clincy, V. (2015). Mobile Phishing Attacks and Mitigation Techniques.Journal of Information Security,6(03), 206. Stankovic, J. A. (2014). Research directions for the internet of things.IEEE Internet of Things Journal,1(1), 3-9. Sun, B., Akiyama, M., Mori, T. (2016). Towards Automatically Detecting Promotional Attacks in Mobile App Store. Ur, B., Bees, J., Segreti, S. M., Bauer, L., Christin, N., Cranor, L. F. (2016, May). Do Users' Perceptions of Password Security Match Reality?. InProceedings of the 2016 CHI Conference on Human Factors in Computing Systems(pp. 3748-3760). ACM. Wang, T., Lu, K., Lu, L., Chung, S. P., Lee, W. (2013, August). Jekyll on iOS: When Benign Apps Become Evil. InUsenix Security(Vol. 13). Wei, T., Zheng, M., Xue, H., SongFireEye, D. (2014). Apple Without A Shell Ios Under Targeted Attack. InVirus Bulletin Conference. Xing, L., Bai, X., Li, T., Wang, X., Chen, K., Liao, X., ... Han, X. (2015, October). Cracking app isolation on apple: Unauthorized cross-app resource access on mac os. InProceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security(pp. 31-43). ACM.