Standard & Poor's Exposes Customers' Security

Event Summary

Standard & Poor's (S&P), a division of McGraw-Hill, knowingly exposed their customers to information security vulnerabilities through their SPComstock analyst service. The security vulnerabilities, originally discovered in January, allowed customers to break into any other customer networks via their MultiCSP turnkey Linux box.

The stock quote service, which is provided to customers through a leased line, provides stock quotes and news on dedicated circuits.

Market Impact

Standard & Poor's was notified of this problem in January, and did little to reconcile the many security holes. The problem was first reported to S&P by customer Kevin Kadow, Network Security Analyst for MSG.net, and has been further verified and researched by Stephen Friedl. According to inside sources, as of March, S&P was still shipping out insecure boxes that had been changed only by cosmetic differences.

Once bad guys get into the box by using one of the many security holes, there exists the possibility to:

• Illegally alter published interest rates
  
  
• Illegally alter equity fund data
  
  
• Illegally alter earnings and balance sheet information
  
  
• Illegally print phony news stories
  
  
• Illegally change published dividend rates

Figure 1. S&P, a division of McGraw-Hill lags their own index.

User Recommendations

Just because a leading brand-name offers what appears to be a reputable product, don't assume that they have taken due diligence when it comes to security. When purchasing any service or hardware device, make sure you change all the default passwords before using the box or service on the network.

• If you are the owner of one of these boxes, the first thing you should do is change the default passwords and make sure that all accounts are passworded. At the very minimum, select a password that has at least eight characters, and has mixed case characters in them, making sure that the password does not include any dictionary listed words.
  
  
• The local administrator of this box should shut down all network services that are not needed. The best thing to do would be to contact your S&P account representative and ask them what network services the Comstock product actually requires.
  
  
• Remove the /etc/issue file that reveals current system information about the box that could be obtained during reconnaissance scans by bad guys.
  
  
• Put your Comstock box behind a firewall. Setup your firewall to block all outbound traffic. This will keep your Comstock box from being used as a launch pad for stolen software (warez) and other nefarious network activity.
  
  
• Put an intrusion detection system between your border routers and firewall in order to detect unsavory network activity before affects your network.

Glossary

warez: A term used by software pirates use to describe a cracked game or application that is made available to the Internet, usually via FTP or telnet, often the pirate will make use of a site with lax security.

Widely used in cracker subcultures to denote cracked version of commercial software, that is versions from which copy-protection has been stripped.