Aug 18

…how often companies botch the termination process for an employee with “destroy the network access” and are then shocked, shocked I tells ya, when the network, is in fact, destroyed.  This week’s episode is especially chock full of security fail…  Network administrator dude resigns from company over a dispute with a senior manager.  His former manager (and close friend) convinces company to keep said dude on as a consultant due to his deep knowledge of said company’s networks (FAIL!!!).  Fast forward a few months… the manager/friend now finds out that *he* is about to be laid off.  He refuses to hand over some passwords and his buddy logs in using valid credentials from a local McDonalds and deletes a bunch of VMs… according to a story on Wired’s Threat Level Blog

“The Feb. 3 attack effectively froze Shionogi’s operations for a number of days, leaving company employees unable to ship product, to cut checks, or even to communicate via e-mail,” according to the complaint filed against him, which asserted that the hack cost Shionogi about $300,000. That figure rose to $800,000 in later court documents.

Really, really basic controls broke down here… if someone with “destroy the network access” is upset enough to leave the company (especially in a crappy economy like we are in now) – show them the freaking door and cut all of their access before it hits them in the ass on the way out!  And don’t allow vital knowledge to accumulate in one person’s head, making them irreplaceable.  Finally, make sure that there are checks and balances in the termination process to insure that these steps are completed quickly and properly.  This is infosec 101, people!

Share
Aug 15

The latest in anti censorship tech

When I read about Telex, a research project aimed at making it easier to get past Internet censorship, my “split personality” – lover of freedom and justice versus corporate security guy kicked in right away.  You see, if widely implemented, Telex would make it much easier and safer for people living under repressive regimes to get past said regimes’ censorship of the Internets.  Built on client software, some clever crypto in packet headers and servers hosted by friendly ISPs, Telex would turn the idea of a proxy server inside out, effectively making the entire Internet (it’s a series of tubes, you know) one big proxy.

This would be really great – I would love to see the US government as well as non profit organizations host Telex servers to allow people in China, the middle east, and other places where freedom of expression is curtailed… however, Telex would also make my job as a security professional that much more difficult.  By installing a Telex client, the users on my corporate network might be able to bypass the web filtering we have put in place.  While some of that filtering is aimed at keeping people away from “non work appropriate sites,” there are other reasons to filter Internet access in the workplace as well.  For example, we block access to sites known to host malware.  We block access to sites which would put us in violation of various legal and regulatory mandates.  These are all legitimate things to do in a corporate environment, and our employees have unfettered access to the Internet outside of the office.  Employees using a system like Telex would put our company at risk.

Telex is stil in the proof of concept stage and there needs to be a lot more software and infrastructure development done before it can be a reality on a large scale. As I said, I am 1000% pro Telex as a tool for people to bypass repressive regimes’ Internet censorship.  But I think that corporate Internet censorship (hate that word) is another kettle of fish altogether and we security professionals need to keep an eye on Telex and similar technologies.  I feel like I should be dressing like these guys after writing this…

 

Share
Aug 13

Over the past few days, a lot of folks at work have been sending me links to this really excellent XKCD cartoon:

 

I think this really hits the password problem on the head.  With the advent of inexpensive GPU assisted password cracking, as well as more intelligence on the part of the (human) password crackers, the old school password rules of “must have a capital letter, a small letter, a number, and (maybe) a special character” are becoming woefully outdated.  And yes, they are hard to remember.  And most importantly, they make users hate the InfoSec people.  Do they ever bring us home baked brownies as a reward for our password rules?  Nope.

As I tend to always take advice from comic strips when making important decisions, I really like the four dictionary word idea.  The math seems to work and it certainly seems to be easier on the user.  However, the infrastructure for implementing such a scheme in the systems where it would count (primarily Microsoft Active Directory) would have to exist in order for this to be workable.  I hope that Microsoft and others who did better than me in math take a long hard look at this as a potential solution to password problems.

 

Share
Aug 13

Are Tweets, BBMs, or Facebook updates weapons of mass mayhem?

OK… I have no problem with police departments (such as those in New York City and London) setting up units to look  at (public) social media sites for signs of impending lawbreaking, whether it be morons rioting, morons flash-robbing, or morons planning other mayhem.  More power to them… I think that if you tweet or Facebook your nefarious plans for the world to see, you should have an additional count of felony stupidity added to your charge sheet.  I also have no problem with the authorities turning off communications facilities when there is a credible and imminent threat to life and limb, such as the possibility of a cell phone triggered improvised explosive device.  But, when I first read about the Bay Area Rapid Transit (BART) police’s move this past Thursday evening rush hour when they disabled cellphone communications on the underground portions of the BART system, I felt very uncomfortable.  This sounds like something that repressive regimes like Egypt, Syria, or Libya would do to their people, not something which could happen in the US.  Then I read BART’s statement about the cellular interruption and got to thinking:

Organizers planning to disrupt BART service on August 11, 2011 stated they would use mobile devices to coordinate their disruptive activities and communicate about the location and number of BART Police. A civil disturbance during commute times at busy downtown San Francisco stations could lead to platform overcrowding and unsafe conditions for BART customers, employees and demonstrators. BART temporarily interrupted service at select BART stations as one of many tactics to ensure the safety of everyone on the platform.

You can find the full statement here.

First of all, BART probably broke the law by doing this.  It is against federal law to interfere with licensed wireless communications.  Even prisons (which, in my opinion should be able to operate cellphone jammers) have been prevented from doing so in the past.  (Yes, I know that BART did not jam the signals, they simply shut down existing cell sites – the result was the same, though).

Now, depending on what kind of information BART had, there may have been a (morally) acceptable reason for taking action.  For example, if the information was very clear in stating that the types and methods of protests were aimed at inducing overcrowding on platforms (a situation dangerous to life and limb) and there was reason to believe that the threat was credible and imminent, I might have been tempted to make the same decision.  But there are some other factors to consider (apart from the legal issue).

First and foremost, what about people already on the BART system who might need access to 9-1-1?  Well, the NYC subway system has no cell service on its underground portion (thankfully) and manages to have a mechanism (call boxes) for getting help in an emergency.  I assume BART is similarly equipped, so the cell service failure did not totally isolate riders from help.  Yes, had someone been on the phone with 9-1-1, their call would have been interrupted, but they could then resort to the call box – not ideal, but workable.

Second… if BART management felt the threat to be credible and that mobile devices were an integral part of the threat, they really only had two choices – shut down cellular service, or shut down stations where they felt the threat was greatest.  The latter option is not a perfect solution (the protestors would just regroup via Twitter) and would inconvenience thousands of innocent commuters.

We are just not yet equipped to make decisions like this and we need to be.

My takeaways from this:

Mobile devices and social media pose new challenges to law enforcement and new potential dangers to the public (as last week’s riots in London seem to have demonstrated).  Getting a mob together and coordinating their actions is a lot easier than it used to be and law enforcement needs tools to deal with this problem in a way which preserves public order but which also respects the rights of the people to peacefully assemble and protest.  This is not an issue to be left to local police departments – we need to do this at the federal level as it is a constitutional issue.

If we decide to allow law enforcement to disrupt communications to preserve public order, we need to have strict standards as to what constitutes a serious and imminent threat to public order and there must be a process to publicly review any such decision after the fact – and consequences for those who make the wrong decision.  The body that makes the (very quick) decision to pull the plug needs to have both law enforcement and civilian members (maybe a constitutional lawyer?).

Other risks need to be considered – for example, using a bunch of social media bots, a miscreant could create a denial of service attack on communications by creating a “virtual” flash mob that exists only in cyberspace, but looks big and scary.  In addition to inconveniencing the public, such an attack could be used as an aid to committing other types of crime.  If these fake flash mobs were to become a regular event, public support for anti flash mob measures could dwindle, leaving us where we are today.

Hopefully our elected officials will take some time out from serving their special interest masters, playing party politics, destroying the economy, and all of the important work that they love so much to take a look at an important issue in a rational way.  Oh, wait…

 

Share
Aug 10

This morning, Reuters is reporting that the HK stock exchange was forced to suspend trading in a number of names on Wednesday due to a suspected cyber attack on its public web site.

The attack prevented investors from accessing corporate announcements made during the exchange’s mid-day break.  As a result, trading in companies who made such announcements (including such well known names as HSBC and Cathay Pacific) was suspended for the afternoon session.

The general take away from this incident is that attackers look for “low hanging fruit” when choosing their targets.  I am sure that the HK Exchange’s back end systems are protected by many layers of firewalls, intrusion detection systems and other technology.  The public web site is, well, public and is thus by necessity much more exposed to attack – and an easier target.

The lesson?   There really is no such thing as a non critical system these days… every system needs to be designed as if there are hoards of attackers just waiting to pounce… stay paranoid!

 

Share
Jul 01

Interesting analysis of yet another botnet

The malware detected by Kaspersky Anti-Virus as TDSS is the most sophisticated threat today. TDSS uses a range of methods to evade signature, heuristic, and proactive detection, and uses encryption to facilitate communication between its bots and the botnet command and control center. TDSS also has a powerful rootkit component, which allows it to conceal the presence of any other types of malware in the system.

More evidence of the increasing sophistication of malware…

 

Share
Jul 01

It’s not often that I disagree with Bruce Schneier, one of the leading lights of the security world… however, I do have a teensy weensy bone to pick with him regarding one of his recent blog postings.  A recent test conducted by the Department of Homeland Security on its employees found (to no one’s surprise) that people are prone to pick up unidentified USB drives and pop them into their computers with abandon, providing nefarious personages the ability to infect their systems with malware.  Schneier took issue with the following quote from a security expert regarding the study:

Mark Rasch, director of network security and privacy consulting for Falls Church, Virginia-based Computer Sciences Corp., told Bloomberg: “There’s no device known to mankind that will prevent people from being idiots.”

In Schneier’s view, the idiocy really rests with operating system manufacturers who allow their products to access untrusted USB devices with providing the user with any protection and that the users are simply doing the best that they can under the circumstances.  This is where I disagree.

While OS manufacturers should be doing a better job of securing their products against unknown USB devices, in the current situation users need to exercise extreme caution in what they stick into their computers’ USB ports.  Until we have better tools to mitigate this risk, users have to play an active role in protecting themselves and their organizations from USB borne threats.  There has been a lot of news coverage (and at least at my organization, security awareness training) to let people know about the risks of USB devices of uncertain provenance.  I happen to think that the people in my organization are smart (and good looking) enough to remember a few very basic security messages and behaviors needed to protect our systems and networks:

  • Don’t open links or files from strangers
  • Don’t open unexpected/strange links or files (that seem to be) from friends
  • Don’t take USB candy from strangers

Yes, I know that application of these rules will not provide 100% protection from malware, but following them will definitely mitigate the risks involved, which is really the best we can hope for at this time.

So, Bruce, you are still my hero, but I think we need to hold our colleagues to a slightly higher standard in terms of their role in protecting our computers and networks.

Oh, and as for Mr. Rasch’s “idiot” comment, I think he was a bit rough on users in terms of his choice of language.  I would have said “boneheaded” or “Homer Simpson-like” instead.  This is why I am beloved at my workplace.

Share
Jul 01

my brain made me do it!

By alberg deep thoughts Comments Off

I just got done reading an extremely interesting book recently… Incognito: The Secret Lives of the Brain by Baylor University neuroscientist David Eagleman.  Eagleman’s hypothesis is that most of the activity going on in our brains is happening below the level of our consciousness, down in “burned in” subroutines which do most of the heavy cognitive lifting.  Our consciousness is the brain’s “summary” of what is going on both out in the world and inside our heads – the metaphor he uses is that of a newspaper.  While it is impossible to know all of the things going on the world around us, a newspaper gathers up a summary of information we need to know (at least according to the newspaper editors and their corporate masters).  Eagleman theorizes that consciousness is our own newspaper, constructed on a moment to moment basis by the incredible piece of gefilte fish in our heads and that without such a mechanism, we would be overwhelmed by information and sensation and unable to react to the world around us.

The interesting part of the book from a security point of view is Eagleman’s contention that free will is really an illusion and that the decisions we make are determined by organic processes and those “burned in” routines we are not even conscious of.  Neuroscientists have been making great strides in tying brain function to behavior in measurable ways, he says, and as the science gets better, we will be able to better see the connections between antisocial behavior and neural malfunctions.

Of course, this has large ramifications for crime and punishment – if there is an organic basis for criminal behavior, we need a new approach to dealing with criminals, one that protects society by isolating them, but which also focuses on whether future criminal behavior can be prevented through medical intervention.  Eagleman is very clear to say that he does not feel that criminal behavior can be excused by his theory, just that how we deal with criminals needs to change.

This was a fascinating and thought provoking book and is well worth your time.  If you want to get a taste of what Eagleman has to say, The Atlantic has an excerpt from the book on their web site.

Now I am going to go eat a pint of butter pecan ice cream and it isn’t my fault…

 

 

Share
Jun 20

mail's here!

Lourdian Mosuela over at CommTouch Cafe had an interesting post about some foreign exchange themed malware today.  The unsuspecting target receives what looks like a misdirected document that appears to be plans for some foreign exchange stat-arb trading in July.  Of course, opening the file installs malware, and does not reveal any secret plans.  The interesting thing here is that the attacker has taken some time to get to know their audience and has thus made the message more attractive.   This may have been an attack targeted against a foreign exchange firm, or against financial professionals and would probably be much more effective than the standard “I am a Nigerian prince and have I got a deal for you!” message.  The malware arms race continues.

Share
May 25

…at least according to this interesting blog post from OpenDNS’ Allison Rhodes.   It makes sense to me… in the AM, we are all going through our emails, getting ready for the day to come and in a hurry to get caught up with the latest news.  I saw this post as a result of being on OpenDNS’ site from here at the Agahozo Shalom Youth Village, where we are using OpenDNS to provide web filtering to keep the students away from some of the, um, racier sites on the Net.  OpenDNS seems to be a really good, easy to use solution for web filtering in the cloud.  If you have young web surfers at home, you might want to check it out.

Share
preload preload preload