TalkTalk incident management: A timeline

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.theregister.co.uk/2015/10/27/talktalk_incident_management_review/

Contradictory statements issued by TalkTalk regarding the third data breach
the company has experienced this year have provided inadequate information
to the telco's customers about their data, while effectively insulating the
company from questions regarding its security practices with insubstantive,
and at times incoherent, PR emissions.

Following the arrest of a 15-year-old boy on unspecified Computer Misuse
Act offences, The Register recaps:

We first reported on an outage at TalkTalk.co.uk on the afternoon of
Wednesday 21 October. We published the company's first statement on the
matter, which made no suggestion that customers' data had been compromised,
but instead attributed the outage to unspecified technical issues.

"21/10/2015: The TalkTalk website is unavailable right now. Sorry we are
currently facing technical issues, our engineers are working hard to fix
it. We apologise for any inconvenience this may cause."

We were subsequently updated by TalkTalk that the site had been taken down
by the company itself, which does not contradict the claim that the company
was facing technical issues, however comes at a period during which the
company later stated it was not only reacting to a cyberattack but also
informing stakeholders, from customers to the police, of the incident.

"21/10/2015: We have taken down TalkTalk.co.uk temporarily, and normal
service will be resumed as soon as possible."

In fact, no mention of a cyberattack would be forthcoming for the next 24
hours. It wasn't until the evening of Thursday 22 October that TalkTalk
released a statement claiming that it had been attacked, and warning its
customers that their data may have been compromised. This came more than 24
hours after, by TalkTalk's own statement, it had reacted to the initial
attack specifically to protect its customers' data.

23/10/2015: As soon as we realised the website was under attack, we pulled
the site down in an effort to protect data.

Details regarding the attack were, and remain, sparse. In an initial list
of potentially compromised Personally Identifiable Information (PII)
provided to customers, TalkTalk seems to have simply provided a list of all
the information it held on its customers. There was, at this time, no
suggestion of what the attack had been, what it had targeted, and what had
actually been compromised.

"22/10/2015: A criminal investigation was launched by the Metropolitan
Police Cyber Crime Unit following a significant and sustained cyberattack
on our website yesterday ... there is a chance that some of the following
data has been compromised: names, addresses, date of birth, phone numbers,
email addresses, TalkTalk account information, credit card details and/or
bank details."

TalkTalk's statements became increasingly technically incoherent, and
talking to The Register, it attributed the loss of customers' data to a
Distributed Denial of Service (DDoS) attack. A DDoS is only capable of
increasing the load on a network resource - and thus taking a website
offline - and not capable of retrieving information from that resource.
However, as you might recall, TalkTalk had already claimed that the company
itself had taken TalkTalk.co.uk offline.

Talking to The Register, Trend Micro's Rik Ferguson stated that it was
"entirely possible" that there were two attacks, which "went hand in hand,
that a DDoS was used to light a metaphorical fire in the front yard while
the thieves snuck around the back. It wouldn't be the first time."

A smokescreen DDoS was alleged to be the tactic of choice for hackers who
stole the personal details of 2.4 million Carphone Warehouse customers in
August.

TalkTalk, however, suggested it had only been targeted by a single attack
which affected its website, and not its "core systems".

TalkTalk has yet to provide any information about where it was storing its
customers information. Traditionally, distinguishing between a service
provider's "core systems" and "website" may be made in terms of where
customer data was actually stored, with a website being merely a protected
front-end for its actual business operations.

As can be witnessed in the URL of TalkTalk's statement (
http://help2.talktalk.co.uk/oct22incident) the incident is attributed to 22
October - which is a day later than it actually occurred. TalkTalk has
subsequently claimed there were no delays between it realising it was under
attack, it pulling down its site, and it then informing customers that
their data may have been compromised. In truth there were several days in
between these events, and TalkTalk has still to confirm what data may have
been compromised.

On Friday 23 October, Dido Harding was interviewed by the BBC where she
avoided offering specific information about the attack itself. Instead the
CEO claimed to have received a ransom notice via email, further explanation
of which was denied as it involved "a live criminal investigation".

The validity of the ransom demand was not addressed in that interview, but
notably contributed to an attention-deflecting public relations coup as
commentators rushed to suggest attributions and spot TalkTalk data for sale
on the web.

Again communicating with The Register on Friday, the telco claimed it
believed its "systems were as secure as they could be," despite admitting
that not all of the data it held on its customers was encrypted.

When Harding admitted TalkTalk may have not encrypted its customers' bank
details, it was as a claim made to soothe customers by claiming that the
information which had been stolen was "incomplete".

"24/10/2015: We now expect the amount of financial information that may
have been accessed to be materially lower than initially believed and would
on its own not enable a criminal to take money from your account."

This raised concerns regarding TalkTalk's thoughts regarding security -
specifically regarding its means for secure storage. The minor obfuscation
of credit card detail digits may not completely reduce TalkTalk customers'
exposure to phishing emails or identity theft scams. Harding confirmed her
lack of concern over this detail in an interview with the Sunday Times.

"25/10/2015: It wasn't encrypted, nor are you legally required to encrypt
it ... We have complied with all of our legal obligations in terms of
storing of financial information."

TalkTalk's claims that it was not under a legal obligation to encrypt
users' data may be correct,dependent upon interpretation of the Data
Protection Act 1998 (DPA) Principle 7 which states only that:

"Appropriate technical and organisational measures shall be taken against
unauthorised or unlawful processing of personal data and against accidental
loss or destruction of, or damage to, personal data."

Establishing what security measures may be considered "appropriate" will be
key to TalkTalk's attempts to claim it has not negligently breached the
DPA. The telco has so far absolved itself of responsibility, despite
Harding issuing a soft "Sorry" during her BBC interview. TalkTalk's site
denies a breach of the DPA, noting "This is a criminal attack. We have
notified the [Information Commissioner's Office (ICO)] and we will work
closely with them over the coming weeks and months."

The ICO was notified on Thursday evening, at the same time that TalkTalk
went public.

Harding provided a video statement at 1pm on Monday 26 October, although it
offered no more details of the attack, nor did it explain what information
had been stolen and/or used by the criminals to target TalkTalk customers.

"The number of customers affected and the amount of data potentially stolen
is smaller than originally feared.

"We don't store unencrypted data on our site, any credit card info which
may have been stolen has the six middle digits blanked out and can't be
used for financial transactions.

"No My Account passwords have been stolen.

"No banking details have been taken that you wouldn't already be sharing
when you write a cheque or give to someone so they can pay money into your
account."

Following the arrest of a 15-year-old boy on Monday evening, within a week
of the cyberattack on TalkTalk's website, the company stated its
victimhood, bemoaning the fact that "cyber criminals are becoming
increasingly sophisticated and attacks against companies that do business
online are becoming increasingly frequent."

At this juncture, Harding began to loosen up about the company's approach
to customers wishing to terminate their relationship with the data-spaffing
telco.

Harding, an avid vlogging enthusiast, delivered another piece to camera
with this suggestion:In the unlikely event that money is stolen from a
customer’s bank account as a direct result of the cyber-attack (rather than
as a result of any other information given out by a customer) then as a
gesture of goodwill, on a case by case basis, we will waive termination
fees.

Additional information provided by TalkTalk suggests there are three
requirements before current customers will be allowed to cancel their
contracts:

You have had money taken from your account without your consent and you
have incurred a financial loss as as result.
The money was taken on or after the 21st October 2015.
You have contacted Action Fraud and obtained a Crime Reference Number.

TalkTalk additionally is accepting no liability for other possible expenses
customers may have to bear as a result of the breach.

The Register has contacted TalkTalk and made many enquiries regarding its
security practices. We had not received any answer to our enquiries at the
time of publication.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!