Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cybersecurity Company Extorted Its Clients, Says Whistleblower

Posted by Soulskill on from the your-computer-is-broadcasting-an-IP-address dept.

An anonymous reader writes: Richard Wallace used to be an investigator for Tiversa, a cybersecurity company that sells services like "breach protection" and "incident response." These days, Wallace is testifying in federal court that Tiversa faked breaches to encourage sales, and extorted clients that weren't interested. For example, Wallace said Tiversa targeted a cancer testing center called LabMD in 2010, tapping into their computers and downloading medical records. Tiversa then used those records as evidence to convince LabMD they had been hacked, offering its "incident response" service at the same time. LabMD didn't fall for it, so Tiversa told the FTC about the "hack." The FTC, none-the-wiser, went after LabMD in court, eventually destroying the business. Wallace has also cast suspicion on reports Tiversa has issued, including one saying President Obama's helicopter blueprints were found on Iranian computers.

3 of 65 comments (clear)

  1. Tiversa breached systems? by Anonymous Coward · · Score: 4, Interesting

    So Tiversa breached systems to get data from them to show the system owner that they needed their services?

    But if Tiversa did breach those systems, then they did need Tiversa's services didn't they?

    1. Re:Tiversa breached systems? by JWSmythe · · Score: 4, Interesting

      That's probably the biggest reason to have good in-house security people. They don't have a financial interest to make breaches or lie about them. It's in their best interest to keep everything secure, and continue to look for new ways to attempt breaking into their own stuff.

      I've never felt good about letting third parties in to do security testing. When someone above my rank decided to let a 3rd party do external tests, they'll pick anything and make it sound disastrous. One place was bitching about anything.

      They complained that we had the current version of Bind running on the DNS servers. "But people can do DNS requests!" Yup.

      They flagged the fact that we dropped unwanted traffic at the firewall. Yup. Get over it. They were upset it took forever to scan the network. Good.

      They flagged us for having a web server providing static content. They were upset they couldn't find any way to exploit CGIs or do SQL injection. Yup. That was kind of the idea.

      There were a whole bunch of other trivial things that they flagged us for. Then they were brought to the office, and got upset that we didn't provide wifi. Nope, that's a security risk. They wanted to plug their laptop into our network, so they were only given external access. Again, they bitched. But letting an unknown computer owned by an unauthorized party plug into our network is a security risk.

      They eventually gave up trying to bully us into dropping our security precautions and gave us a pass.

      I already habitually ran tests with privileged access to make sure even if all layers of protection failed, nothing really bad could happen.

      Honestly, if they are given everything, they can find something. Give them administrative rights to everything, and credentials to everything, they can find something. Like, email accounts can be accessed with full admin rights. Funny how that works.

      --
      Serious? Seriousness is well above my pay grade.
  2. They reveal themselves ! by redelm · · Score: 5, Interesting

    Hmm ... Iran has blueprints ... sounds bad. But of _course_ they have blueprints of that model helo -- the Shah bought them prior to 1979! Marine One is [usually] a Sikorski VH-3 "Sea King" which first flew in 1959.

    When advocates make inflammatory claims that have innocent explanations, I consider them confidence crooks. They know their best arguments and have made them. Yet another example of lies being more revealing than the truth (so long as you already know it.)