MyFitness self-service portal accounts created with weak default passwords

The self-service portal of the biggest Estonian sports club MyFitness has a major flaw, which allows for strangers to easily log in to the accounts and see people personal information. The club already knows the mistake for a month, but it has not been fixed so far.

The test showed that knowing the MyFitness client’s completely public information is possible to sign in to his account if he has not manually changed his password. Namely, the client will be assigned a default password when opening a self-service account, which is very easy to guess even to completely strangers. Another problem is that the client is not forced to change this password after logging in, which means that people will continue to use the unsecure password. Thirdly, the person’s password is sent to them in plain via e-mail, making it easy for it to leak.

Signing in to a person’s account will at least allow to see his contact details, contracts with MyFitness, training preferences, history and schedule.

The username is incremental number and the password is the last name of the account holder. MyFitness was informed about the flaw through CERT-EE already year ago.
This is another example that some flaws get fixed only after they are published in media.

Links:
https://geenius.ee/uudis/myfitnessi-iseteeninduses-laiutab-isikuandmeid-paljastav-ulilihtne-turvaauk-ettevote-pole-kuu-ajaga-seda-parandanud/

Contactless card payment limit rises to 25 EUR

All banks, which issue contactless credit cards in Estonia, starting from October 16 will raise the payment limit from 10 to 25 EUR.

“The ten euro limit established in Estonia initially proved that both consumers and merchants are interested in the new payment method and it is also safe, because only the special equipment for which a contract with the bank is necessary is required to pay the payment,” said Meelis Nurk, chairman of the banking union card working group.

15% of the bank cards used in Estonia are contactless cards. By the end of the year, 80% of payment terminals should support contactless payments; by 2020, all terminals must be able to provide pay-as-you-go payments.

In Estonia the contactless payment cards are issued by Swedbank, SEB Pank, LHV Bank, Krediidipank and Nordea Bank.

Links:
http://kasulik.delfi.ee/news/uudised/viipemakse-limiit-touseb-kumnelt-eurolt-25-euroni?id=79535098

SK Annual Conference 2017

E-identity event SK Annual Conference 2017 will take place on November 2, 2017, Baltic Station old waiting area (Toompuiestee 37, Tallinn).

Agenda:
09:00-09:30 Registration and morning coffee
09:30-10:30 Overview of SK 2017, Kalev Pihl, SK
10:30-11:00 Smart-ID: fast start and future plans, Kaido Irval and Georg Nikolajevski, SK
11:00-11:15 Cofee Break
11:15-11:45 The future of authentication in SEB. When will the code cards disappear? Ragnar Toomla, SEB
11:45-12:15 TBA
12:15-13:00 Lunch
13:00-14:00 Keynote: Pablos Holman
14:00-14:45 Panel discussion, Pablos Holman and Taavi Kotka
14:45-15:00 Cofee Break
15:00-15:30 TBA
15:30-16:00 eID year in retrospect, Anto Veldre, RIA
16:10-16:40 Round of question and answers
16:40-17:00 Summary of the day by digital world enthusiasts
17:00-18:00 Evening snack

Registration till October 20.

Links:
https://www.sk.ee/ettevottest/sk-aastakonverents/aastakonverents-2017

RIA Cyber Security Report 2016

The Estonian version of the report was released already in March.

One interesting piece of information disclosed in the report is the case of targeted attack against the SCADA system used at Viru Keemia Grupp AS. The case was also widely covered in Estonian media.

In 2016, traffic bearing the hallmarks of malware was spotted in the computer network of Viru Keemia Grupp (VKG), an Estonian group of oil shale, power and public utility companies. Software experts found the Mimikatz malware in the VKG office network, used in Windows systems to extract identity credentials (such as passwords, password hashes etc.). [..] Upon further investigation, it was found that a workstation in the SCADA monitoring segment was infected. The workstation was then removed from the network. Network traffic and examples of malware found on computers all pointed to a targeted attack. The malware and control server used have been linked to the APT28 cyber espionage group.

The report also includes RIA position statement on technology backdoors:

From Estonia’s perspective, strong encryption is vital for ensuring trust in the state’s digital services, as all of the e-services provided by the government and many private sector e-services are based on strong encryption (Estonian digital identity). In the longer term, building in backdoors would thus reduce trust in the digital state, but trust is an extremely important value for Estonia. As a result, Estonia has not supported building backdoors into e-services, and the objective and function of RIA continues to be to ensure the high level of trust in Estonian digital identity.

Links:
https://www.ria.ee/en/ria-cyber-security-more-important-than-ever.html
https://www.ria.ee/public/Kuberturvalisus/RIA_CSA_2017.PDF

Use of password cards for online banking will be limited

Modern security requirements will also be applied to online payments, which is why the field of use of password cards will be limited. The bill will also seek to coordinate Estonian laws with the new European Union Payment Services Directive.

In the future, payment service providers must apply so-called strong authentication requirements when identifying a customer. In Estonia, for example, it means ID-card, mobile-ID, as well as different applications and password calculators. To reduce the security risks associated with payments, the use of existing password cards will be limited because they are easily copied. Limitations also apply to those online payments, where a combination of numbers printed on a bank card is used as the only security feature.

The security measures in question are expected to fully enter into force in the first half of 2019. The exact date depends on when the European Commission will approve the relevant implementing regulation.

Links:
http://news.err.ee/612354/government-approves-amendments-to-payment-institutions-act
http://majandus24.postimees.ee/4206571/uue-eelnouga-muutuvad-makseteenused-turvalisemaks

Workshop on source code of Estonian i-voting system in Tartu hackerspace

On Friday Sep 8th from 18:00 we will discuss next generation source code for Estonian e-voting software.

The code was published on GitHub Sep 5th, which leaves us exactly a month to check it out, test it and hack it. To give this new national sports of hacking e-voting a good kickoff we have a) invited coders behind the system to introduce the code to us and we will host b) a brainstorming session on what interesting hacks we can come up with. Let’s see where it goes!

Everybody is welcome, however some tehcnical knowledge about software and coding will help a lot to make the event meaningful for you.

Links:
https://hackest.org/syndmused:2017-09-08_i-voting

RIA is looking for Internet voting penetration testers

According to the terms and conditions of the contract, the subject of audit is: ballot counting software, software for voters, election web site and other technical infrastructure related to e-voting.

Through this, the RIA wants to make sure that there are no vulnerabilities in the system or applications which would make it possible to see or change the voting results or otherwise manipulate the system. The security examiner must draw up a report on security threats in which the potential hazard scenarios are highlighted and suggestions on how to correct the errors are provided.

The testing is organized by the RIA before all elections, using the expertise of various experts. “We can not talk about the results of the earlier security tests, because this information is confidential in terms of security. As far as I can say, the current testing period is around one month, and it also leaves enough time to ensure that if there are any bottlenecks or security problems we will have time to fix them.” said RIA spokeswoman Helen Uldrich.

Indeed, the results of the penetration tests are kept secret. The terms of the procurement stipulate that at the end of the test the reports must be submitted digitally signed and encrypted. Security tests are performed in a test environment and if necessary a secure channel for testers can be created. The i-voting environment is open only to computers with specific IP addresses that are notified to RIA.

Two companies have been chosen to do pentest and two bugs have been found:

Penetration tests were carried out by Clarified Security from Estonia and the worldwide Finnish company Nixu, whose work resulted in detection of two errors in the new system. According to specialists, this is not something tragic, but part of the normal software development.

 

Links:
http://www.err.ee/610258/ria-otsib-e-valimiste-proovihakkijat
http://www.err.ee/634302/pealtnagija-e-valimistele-leidub-endiselt-kriitikuid

Interdisciplinary Cyber Research (ICR) workshop 2017

8th of July, 2017 — Tallinn, Estonia

The aim of the workshop is to bring together young as well as established scholars undertaking research in various disciplines related to information and communication technologies such as computer sciences, political and social sciences, and law.

You can participate as a speaker (submitting an abstract+delivering a presentation) or simply join our wonderful audience. Speakers are requested to submit a 1000-word abstract.

Agenda:
08:30 – Registration
09:00 – Opening words, Dr Anna-Maria Osula & Prof Olaf Maennel
09:10 – Keynote, “The Triangle of Impossibility: Strategic Decision-Making and Cyber Security”, Mr Lauri Almann
10:05 – Keynote, “The Truth about Hacking. From Russia to Hollywood.”, Mr Ralph Echemendia
11:00 – Coffee break

11:30 – 13:00 SESSION 1: Big Data & Privacy
Ms Kärt Pormeister, “The GDPR as an Enabler for Big Data: What Does it Mean for the Data Subject?”
Ms Maris Männiste, “Social Media and Big Data”
Ms Julija Terjuhana, “Right to Data Portability”
Mr Alexander Mois Aroyo, “Bringing Human Robot Interaction towards Trust and Social Engineering – Slowly & Secretly Invading People’s Privacy Settings”

11:30 – 13:00 SESSION 2: Security
Mr Alessandro Borrello, Mr Sioli O’Connell & Mr Yuval Yarom, “Is Dynamic Analysis of Android Applications More Effective Than Mass Static Analysis at Detecting Vulnerabilities?”
Mr Ben Agnew, “Security Applications of Additive Analogue Memory”
Mr Richard Matthews, “Isolating Lens Aberrations within Fixed Pattern Noise”
Mr Muhammad Imran Khan, “On Detection of Anomalous Query Sequences”

13:00 – Lunch
14:00 – 15:30 SESSION 3: Privacy (cont) & Cyber Crime
Dr Xingan Li, “Social Networking Services and Privacy: An Evolutionary Notion”
Mr Sten Mäses, “Gone Phishin’ (But Not to Jail)”
Mr Kristjan Kikerpill, “Cybercrime Against Business: Who Draws the Short Straw?”
Ms Anne Veerpalu, “Blockchain Technologies”

14:00 – 15:30 SESSION 4: Applied IT-Security
Prof Tobias Eggendorfer, “Using Process Mining to Identify Attacks”
Ms Belgin Tastan, “Electronic Identification System – How to Adopt, Expanding and Provide One Card for All”
Mr Aykan Inan, “Project IVA”
Mr Ayden Aba & Mr Jackson Virgo, “Equity Crowdfunding with Blockchain”

15:30 – Coffee break
15:50 – 17:00 SESSION 5: State and Cyber
Ms Maarja Toots, “Why Do e-Participation Projects Fail? The Case of Estonia’s Osale.ee”
Mr Georgios Pilichos, “Securitization of Cyberspace”
Mr Madis Metelitsa, “Addressing the Security Dilemma in Cyberspace”
Ms Somaly Nguon, “Cambodia’s Effort on Cybersecurity Regulation: Policy and Human Rights’ Implications”

15:50 – 17:00 SESSION 6: eGovernment & Security
Mr Harish Gowda & Mr Matt Reynolds, “Real-Time Video Stream Substiution”
Mr Nicolas Mayer, “The ENTRI Framework: Security Risk Management Enhanced by the Use of Enterprise Architectures”
Mr David Hubczenko, “Investigation into Twitterbot Identification Techniques”
Mr Lachlan Gunn, “Geolocation of Tor Hidden Services: Initial Results”

18:00 – Social snacks at “August”, Väike-Karja 5

Links:
http://cybercentre.cs.ttu.ee/en/icr2017/

SK ID Solutions declared provider of vital services

The Identity Documents Act was amended declaring the provider of certification services a vital service provider:

(31) The provider of certification service that enables digital identification and digital signing with the certificate which is entered in the documents issued on the basis of this Act is the provider of vital service specified in clause 36 (1) 8) of the Emergency Act.
[RT I, 03.03.2017, 1 – entry into force 01.07.2017]

In practice, at least currently the new status does not introduce significant new requirements, since for SK as a qualified trust service provider the operational requirements set by law were quite high anyway.

Links:
https://www.riigiteataja.ee/en/eli/521062017003/consolide

Personal data tracker service allows to infer activities of other persons

From the March of this year everyone is able to check on the eesti.ee portal, which state agencies have reviewed their data from the population register. The new service is a matter of grave concern to notaries who are required to make inquiries into the population register, for example, if it is necessary to find out whether real estate may be the joint property of spouses or former spouses, or if it is necessary to organize succession proceedings based on data, including identifying potential heirs. According to Eve Strangi, Chief Executive Officer of the Chamber of Notaries, after the Data Tracker service came into being, people who did not use the notarial service themselves, but whose parents, children or spouse had done this, also came to the notice that personal data was viewed.

In most cases, people can get information that their data has been viewed, but not always. “An exception, for example, is the situation where heir data is required to make a will. However, the will until the death of the maker is secret, and the existence and content of the act can not be disclosed to the heir earlier than specified by the law.

Heiko Vainsalu, Head of the State Information System Agency X-Road, said that the Data Tracker highlighted weaknesses in information systems, which should now be addressed by the authorities themselves. “It is now up to the authorities to eliminate them – to improve the logic of data services and to find data services better suited to specific needs. Besides the ability to track the use and processing of the data in the state information system, the Data Tracker helps to highlight and correct the design mistakes of information systems.”

Some filters are needed. For example, the queries made by law enforcement institutions in investigating the crimes must not show up to the subjects in the Data Tracker service.

Links:
http://arileht.delfi.ee/news/uudised/andmejalgija-paljastas-notarite-salajased-toimingud?id=78131976