A Data Breach in Who-Ville

A Data Breach in Who-ville

This holiday season, however, after a year of nasty data breaches, it feels appropriate to take Dr. Seuss’ How the Grinch Stole Christmas[2] and analyze it with some of the basic questions we ask during a data breach.

It’s impossible to say for certain, but I suspect that when Theodor Geisel published his first Christmas related book in 1957 and Dave Shackleford published a whitepaper[1] in 2012, neither of them expected to be referenced alongside each other. This holiday season, however, after a year of nasty data breaches, it feels appropriate to take Dr. Seuss’ How the Grinch Stole Christmas[2] and analyze it with some of the basic questions we ask during a data breach.

Since we don’t know exactly where Who-ville is, perhaps it exists on a circuit board and those wrapped Christmas gifts represent folders and files, after all it’s likely the first recorded use of “heap overflow.” Instead of the lyric stating, “Your soul is an appalling dump heap overflowing with the …”, perhaps it actually reads, “Your soul is an appalling dump. Heap overflowing with the …” This means that it’s quite possible that Who-ville is simply down the information superhighway from the Game Grid.

Since the Grinch successfully pulls off his attack, let’s take a look at Shackleford’s ‘Top Five Questions to Answer After a Security Breach.’

What Systems and Data Were Affected?

The stockings were the first thing to go. “Pop guns! And bicycles! Roller skates! Drums! Checkerboards! Tricycles! Popcorn! And Plums!” Ultimately, every festive item was taken from every resident of Who-ville. He picked their houses clean and all of their food, taking even crumbs from a mouse. At one point, the Grinch even destroys data, ripping out the magnetic tape from its casing. There’s no need to assume that Who-ville is digital, we’re seeing a physical representation of data loss.

How Did They Do It?

This is where a lax approach to security came back to bite the people of Who-ville in the bottom. The Grinch managed to bypass security with a ladder and exploit the vulnerable chimney for entrance. In other cases, he was simply able to pass from building window to building window by conveniently placed ropes used to string up decorations. In technical parlance, the rope could represent shared credentials or an already established SSH tunnel between the hosts. This is where simple patches like a chimney cap or closed windows could have prevented the majority of the loss.

Who Did This to Us?

As outsiders watching the situation unfold, we know who the culprit is… The Grinch and his accomplice Max. In his whitepaper, Shackleford suggests determining the category of the attacker with three sub-questions:

Is the event externally or internally based?

This one appears obvious on the surface. It was an external attack, as the residents of Who-ville were left with nothing after an attacker entered their village. It is possible, however, that this may be considered a joint attack. “If you see something, say something” is a popular phrase utilized for a number of purposes, so you have to ask yourself, “Why didn’t Cindy-Lou Who say something when she saw ‘Santy Clause’ taking the tree?” Perhaps this attack wasn’t as external as Dr. Seuss would have us believe.

What is the attacker’s motivation?

It’s definitely interesting to watch an attack from the outside as we have explicit knowledge of this. The Grinch hates Christmas (perhaps due to his heart being two sizes too small). His goal was to prevent Christmas and avoid the singing and noise that would befall his ears on Christmas day.

Where is the attacker located?

Again, simple to see, Mt. Crumpit. Having an attacker this close and having such lax security could make it tempting for repeat attacks to occur.

Is It Really Over?

Ultimately, The Grinch returns the assets but instead of being prosecuted under the Computer Fraud and Abuse Act, he’s invited to dinner. Not only does he join the people of Who-ville at a large dinner, he actually gets the honor of carving the rare Who roast beast. The Grinch joining them could be considered unusual system activity. Perhaps he’s actually positioning himself as an insider threat for future attacks

Can It Happen Again?

This is where Shackleford suggests a few steps to minimize the risk of the breach happening again:

  • Know and understand what is running in the environment and how it commonly behaves.
  • Go over the root cause again.
  • Reconstruct events.
  • Remediate security controls and improve user training.

Unfortunately, the residents of Who-ville clearly don’t care about this list. After the breach occurs, they simply go about their daily lives. Sure, there are no presents to open and there’s definitely no food to eat, but they still gather outside to ring the Christmas bells and sing a song. Without patching the chimney and windows or determining if Cindy-Lou represented a threat, they are left with a high likelihood of a repeat occurrence. This likelihood is increased as they allowed the attacker to embed himself within in their community.

While Geisel wrote How the Grinch Stole Christmas as a criticism of materialism and consumerism in the 1950s, it serves as a decent parable for data security in modern era. Data breaches often occur due to lax security within an enterprise and all-too-often consumers behave as the residents of Who-ville did after learning of the breach… simply carrying on with their lives without a care to what’s been lost. Unfortunately, we never got How the Grinch Stole Christmas 2, so we’ll never know if their naiveté caught up with them, but we can watch similar events unfold with the next major data breach.  Regardless of what happens, I think we can all agree that hackers are “a three-decker sauerkraut and toadstool sandwich with arsenic sauce.”

Featured

  • Bringing it Together

    Public safety communications have long been used to help first responders save lives and to help keep first responders safe, improve response time, and enhance interagency coordination. These communication solutions may include mobile (5G), radio telecommunication and mass notification systems. Read Now

  • Exploring the Future of Video

    AI innovation is rapidly transforming video security. Edge-based AI centered on object detection excels at detecting people and vehicles to alert to threats like brandished guns or perimeter breaches. However, the onus is on the user to gather more details to fully understand the situation. Read Now

  • Allegion, Comfort Technologies Implement Mobile Credentials at the Artisan Apartment Homes in Florida

    Artisan Apartment Homes, a luxury apartment complex in Dunedin, Florida, recently transitioned from mechanical keys to electronic locks and centralized system software with support from Allegion US, a leading provider of security solutions, technology and services, and Florida-based Comfort Technologies, which specializes in deploying multifamily access control, IoT devices and software management solutions. Read Now

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.