Late last month, Paypal announced that TIO Networks, a company it acquired in July 2017, experienced a major data breach that has compromised the sensitive information of approximately 1.6million customers.

While Paypal has publicly acknowledged the breach, which could have occurred any time before it acquired TIO, customers are still unaware of the impact the brief and Paypal has yet to contact customers to notify them of the data that may have been accessed.

However, in a statement Paypal did say it had “identified a potential compromise of personally identifiable information for approximately 1.6 million customers.”

Paypal should be commended for identifying the breach and taking full responsibility. However, introducing free identity theft insurance and credit checks shows us that the information that may have been breached is incredibly sensitive – and could possibly be used to damage a credit rating or for identity theft. Further to this, Paypal has stated that TIO services, “will not be fully restored until [PayPal] are confident in the security of the TIO systems and network” a measure it has taken in order to protect its customers.

For all the work Paypal is doing to address the impact of this breach, it’s interesting to see just how long it has taken to identify and respond to the breach. According to reports, the breach occurred sometime before the acquisition and was announced a full four months later, in November.

TIO Networks and Paypal stand as a message to other companies: the question you’re asking shouldn’t be: will a breach occur? But when will a breach occur or has one occurred?

Recorded Network History lets SecOps teams quickly find, rewind and playback relevant network traffic and investigate security alerts before they turn into more serious breaches . And in the event of a breach like TIO’s, recorded Network History could have also allowed their SecOps team to get ahead of the breach before it was found by Paypal.

For the TIO Networks analysts, the ability to go back and examine the packets to see exactly what happened on their network could have substantially reduced the damage caused by the hackers. And for Paypal, it could have prevented a financial hit.

This breach also highlights the need for cybersecurity audits to be included as a key part of the due-diligence process when companies are looking at potential acquisitions. As we saw with the purchase of Yahoo, the potential cost of dealing with an inherited breach can have a significant impact on the value of the company. Knowing the risk of having to deal with such an inherited breach can help the acquirer to avoid being hit with significant unexpected costs.

With EndaceProbes Network Recorders SecOps teams can investigate and respond to data breaches quickly and conclusively.

In the event of a breach they can be sure exactly what happened: how the attacker got in, and what was compromised. Which means they can respond appropriately – offering credit and identity theft protection to their customers, or not if the breach wasn’t sufficiently serious to warrant it.

Endace was the proud sponsor of the Royal Navy at the Birmingham International Tattoo 2017.

For those not familiar with the pomp and ceremony of such events, the tattoo is an elaborate celebration of the military. It includes music, advanced drill, dance and, most importantly, a Field Gun competition.

 

Endace was a previous sponsor of MOD Corsham’s Tri-Service Field Gun Crew, which won the Plate 1 Final at the Royal Navy Royal Marines Charity Field Gun Competition at HMS Collingwood. So when we were invited to be the sole sponsor of the Royal Navy at the 2017 International  Tattoo in Birmingham we were thrilled to accept the opportunity to support this highly enjoyable event.

 

The team from the Royal Navy performed admirably over the two days. Well done to everyone in what was an extremely tough competition!.

Take a look at the video below to see the team in action:

It was an interesting week at SharkFest Europe 2017 this month. The Annual Sharkfest conference ran from 7th-10th November at the rather comfortable Palacio Estoril in Estoril, Portugal. Endace was there and our CTO, Dr. Stephen Donnelly, presented a session on packet capture meta-data.

This was the second Wireshark Europe event and was very well attended, attracting attendees from more than 30 countries. Congratulations to Janice and the team for an excellent event – and we look forward to hearing more about the inaugural Wireshark Asia in due course.

Stephen’s presentation, ‘Augmenting Packet Capture with Contextual Meta-Data: the What, Why & How’, was well received by the audience.

For those who couldn’t make SharkFest, here is a video of the presentation (if you’d like a copy of the full presentation please let us know)

Stephen outlined the importance of retaining context for packet capture files by pointing out that the oft-use line “Packets Don’t Lie” isn’t true if:

• You don’t know where they came from
• You don’t know if there was packet loss
• You don’t know if they’ve been filtered
• You don’t know if the time stamps are right

This becomes even important in environments where packet capture is happening in multiple places across a distributed network. Understanding where the packets came from, and what the state of the environment was like at the time, is crucial if you are to draw solid conclusions from examining the packet trace file.

The role of metadata, Stephen argues, is to provide this context. He went on to talk about some of the different types of packet capture metadata and what it can be useful for, outlining three main categories of metadata:

• Static metadata: data about things that do not change over time, such as the host name of the system that captured the packets, the speed of the link and so on.
• Dynamic metadata: data about environmental conditions that change over time – such as optical power levels or timing accuracy.
• Post-capture metadata: data such as user comments, flow information, statistics and annotations from analytics applications that process the captured packet data.

Stephen took a deep dive into three common formats for packet trace files – pcap, pcagng (now the default format in Wireshark) and Provenance™ and approach to writing metadata used in Endace’s Extensible Record Format (ERF) (which is also compatible with Wireshark). The presentation looked at what each offers in terms of  recording packet capture metadata and how they go about associating it with packet trace files.

Provenance uses a different approach to writing metadata into packet capture files from either pcap or pcap ng. Provenace is designed to be able to record changing (dynamic data) that may change during the course of a packet capture. It works by writing a Provenance record into the ERF capture file once every second, as the diagram below shows.

One of the use cases for this is recording the accuracy of time stamping information over the course of a packet capture of high-frequency trade data. Under new MiFID 2 regulations which come into force in 2018, traders must record every trade and be able to demonstrate that the recorded trade data is timestamped accurately to a time-source that is synchronized to UTC with a maximum divergence of less than 100 microseconds. Provenance provides an easy way for them to record compliance with this regulatory obligation.

If you have an interesting use case for packet capture metadata (particularly post-capture metadata use cases), we’d love to hear more. Let us know. We see this as a fascinating area for further development.

SharkFest was an excellent opportunity for the Endace team to meet like-minded members of the Wireshark global community, including the original creator of the Wireshark Core Developers, Gerald Combs, and to share knowledge of the best practices in packet analysis.

We’re looking forward to seeing how SharkFest continues to grow in scale and influence, with three SharkFest events taking place in 2018, including the first-ever SharkFest Asia in Singapore.

Last week saw the 10th Annual SharkFest conference held in Pittsburgh at Carnegie Mellon University.

SharkFest is a conference for developers and users of the open-source Wireshark application, and draws a varied audience including people from NetOps, SecOps, Telcos, Government, industrial plant operators and manufacturers as well as vendors.

One of the real strengths of SharkFest is that it’s not too big. While large enough to attract Wireshark users and developers from around the world, SharkFest still remains intimate enough for the attendees to have plenty of opportunity to engage with Wireshark’s creator and lead developer, Gerald Combs, and core Wireshark developers and to have input into the future direction of Wireshark.

Amongst all attendees there was general recognition of the growing importance of packet history in providing ground truth for investigating security events and troubleshooting network problems. There was also recognition of the growing importance of continuous – as opposed to ad-hoc – packet capture in providing evidence for security investigations, and a number of presentations referenced the challenges of multi-point packet capture.

Endace CTO, Dr Stephen Donnelly, spoke about augmenting packet capture with contextual metadata – which becomes especially critical when implementing multi-point continuous packet capture solutions. Metadata allows packet history to be self-describing, so its context can be carried along with the data wherever that data may be consumed. Stephen’s SharkFest presentation is online and can be viewed below.

SharkFest is always a very interesting and valuable conference. It is a great opportunity to be part of helping to shape what has become an incredibly important tool for our industry.

Endace was very pleased to be a sponsor at SharkFest 2017, and we’re looking forward to SharkFest Europe later in the year too. Thanks to the SharkFest team (and the fantastic Janice Spampinato) for all your help. Great job!