HackerCode

Wordpress Security Plug-ins

Martin McKeay has pointed out two new-to-me Wordpress security plug-ins. The first is an installation scanner that helps identify risky settings. The second is an automatic upgrade plug-in.

Wordpress doesn't have the greatest security record in the world. This graph from the National Vulnerability Database illustrates the number of medium to high risk vulnerabilities in the software over the last five years:

Security is one of the reasons I started exploring Movable Type, but for those who still use Wordpress, these plug-ins are invaluable.

RBN Influencing ICANN?

From rbnexploit, RBN - Partners Official Sponsors of ICANN?:

Russian Business Network (RBN); what if they were out to own the Internet by owning the DNS? The Internet totally relies on DNS (Domain Name System) so obviously this must be the stuff that Hollywood movies are made of, but this nightmare scenario is more real than any of us would like to believe.

This article draws a few of the ingredients together, it is important to stress this is not to discredit ICANN, but to show just how RBN and their associates are applying themselves to the weakness of DNS allocation and exploiting ICANN's vulnerability via influence, commercial sponsorship and registrar development.

This one may fall into the tin-foil-hat arena, especially considering the following text:

The background research and this summary article has been around four months in the making within the community. It should be emphasized there is considerably more 'who' and 'what' which will be presented in full later.

The "there's more evidence, but it's secret" line is a classic for conspiracy theorists. It may pan out or it may not, but the article does raise a couple of very interesting points.

First, organizations such as ICANN are designed to be completely open and transparent (and they should be). An completely open dialogue requires full and complete disclosure, however, and it's very easy for malicious entities such as the RBN to participate without that disclosure, which adds significant risk to the process.

Congress requires all lobbyists to be registered so that our representatives know who they're talking to and what interests they represent. It allows them to control to dialogue and keep entities such as drug cartels from influencing US policy. Whether that particular system works or not, it still addresses an important need.

The second issue they raise is one of trust. The most fundamental trust most web entities (such as small online businesses) make is with their registrar and hosting provider. Registrar/Hosting companies have propegated so quickly that reputation economics are useless in making a vendor decision, so price/performance is the metric many entities use in choosing a registrar/hosting solution. This makes it far too easy for entities such as the RBN to victimize their customers without any possibility of recourse.

At any rate, I look forward to any information that makes the article's case more directly. It promises to be interesting.

Google Friends Connect

from O'Reilly Radar, Google Friend Connect Previews Tonight:

Later today Google is going to preview Friend Connect (it's not live yet at http://www.google.com/friendconnect), a product that lets any website host OpenSocial applications. These applications will enable a site's user to interact with their social network from other sites (assuming they are logged in). Initially users will be able to see their networks from Facebook (using their APIs), Google Talk, and Orkut. Future participants will include hi5 and plaxo.

Initially Google will be letting websites in slowly. Upon acceptance webmasters will be able to submit their website (URL and name) and select colors. They can then select applications for their site from a new application gallery.

The user experience is simple. When a user comes to a site in the Friend Connect program they can sign into any social network that is sharing their data. Their data is not actually shared with the site. Impressively Google is supporting OpenID and OAuth in addition to their own standard OpenSocial.

This sounds like it's expanding identity management from the authentication piece that projects such as OpenID and Shibboleth tackle to explore a richer version of identity.

Who'd want to hack me?

Lots of people want to hack you. Despite persistent stereotypes about bored teenagers, cyber-crime is big business. A search on the Russian Business Network should end any doubts about that. Physical world criminals have very simple motives; they're after valuables -- money, jewelry, electronics, cars. Cyber criminals really aren't any different. If you want to know what they're after, follow the money.

Q: "Willie, why do you rob banks?"

A: "Cause that's where the money is."

-- Willy Sutton, depresson-era bank robber

There are three things every user has that are valuable to cyber criminals:

• Financial Assets and Intellectual Property.
• Computing Resources.
• Identity.

The first of these things is the most obvious. Financial records -- including bank account and credit card information -- are almost as good as cash to a criminal. Even if individual assets are modest, when aggregated with other victims, the value of the information is significant and is sold and traded online.

Intellectual property is similarly valuable as the MPAA will attest to. While most intellectual property -- an unfinished novel, plans for the new deck, and the latest vacation pictures -- probably aren't as valuable as a major motion picture, piracy does occur. If the machine contains IP belonging to a commercial, governmental, or academic institution, it could be extraordinarily valuable or compromising.

The value of computing resources isn't quite as intuitive. Every modern computer has storage, network bandwidth, and processing power. All three of these things are useful to a criminal.

Storage is the most obvious commodity they're after. Why would a criminal store black market files on their own machines when they can do it anonymously on somebody else's? All of those pirated movies that the MPAA is hunting down have to be stored somewhere. So does the source code for the most recent catastrophic virus outbreak. And then there's child pornography. There are serious legal consequences if it's found on a computer, and criminals love to transfer that sort of risk to the unsuspecting.

Bandwidth is valuable for similar reasons. A computer's Internet connection connection can be used to host this illicit content for downloading. It can also be used to attack other machines. A botnet is a collection of computers that have been hacked and can be controlled remotely by the attacker. These huge groups of hundreds of thousands of compromised machines can be used in coordinated attacks against individuals, businesses, and nation states.

Processing power is a little bit more subtle. Keep in mind that encryption is at the core of security technology. It's what keeps passwords, communications, and commerce private. Without it, anybody could listen in during online banking sessions and while credit card numbers are sent to online stores. Essentially, encryption is just very complex math which, given a big enough calculator, can be solved. While this doesn't seem as immediate a risk as bandwidth and storage, it does pose a viable long-term threat.

The final and most universal asset that every end user has is identity. This is a dual threat -- first to your personal assets and second to the assets and intellectual property of any person or organization trusts you.

Identity theft is all over the news these days. This type of identity threat is the theft of a victim's real-world identity. But what about a victim's online identity? Highly targeted phishing e-mails that appear to come from a trusted individual or organization are much likelier to succeed than random spam. Another attack would be to use a victim's electronic credentials (usually a password) to access an employer's intellectual property or financial assets -- employees who's username and/or password can be cracked or discovered open an employer's network up to attack from the inside.

Cybercrime is clearly a problem that threatens all types of computer users from the board room to the backyard; everyone is a target.

This document is intended for a non-technical audience. It's a sketch for part of a document I'm working on that introduces business users to online risks and best practices...

Reactive vs. Proactive security

I attended the Institute for National Security Education and Research (INSER) Cybersecurity 2008 event this morning at the University of Washington this morning where I listened to a very interesting talk by Deborah Frincke called "On the Horizon: How Research in Cybersecurity is Changing and How it Remains the Same." While the talk covered a lot of ground, one particular topic sticks out in my mind.

Right now, research dollars and commercial products are focused on responding to the problems we have right now. Keep in mind that issues that are current for defenders were hatched by the attackers days, weeks, or months ago. We basically have two tools in our arsenal that the bad guys made obsolete a long time ago -- signature-based defenses and attacking worm/bot command and control mechanisms. Research into "next generation" defenses are solving two-year-old problems, and there isn't a lot of funding looking even two years to the future, let alone five to ten.

Race to Zero Antivirus Challenge

There's clearly something broken in the economics of information security. This Defcon event isn't serious research into new attack vectors, it's a demonstration of how trivial it is to bypass signature-based products. An open and honest dialogue between security vendors and greyhat reserachers is good thing and should be encouraged -- open research benefits both sides, whereas the blackhats working in the shadows keeps security vendors playing catch-up.

Race to Zero Makes Headlines from DEFCON Announcements!:

The Race-to-Zero anti-virus challenge was announce scarcely a week ago, and already the controversy surrounding it has bubbled all the way up to Wired. The contest's basic premise is that competitors will be given sample virus code and rewarded for modifying that code in such a way that it defeats common AV products.

AV vendors have made their discomfort with the idea clear, with various spokesmen for the industry voicing concern about the creation of new threats to existing AV products. Contest organizers have countered that the contest is categorically not about creating new virii, rather it is about demonstrating the speed with which currently blocked virii can be modified to defeat current virus-blocking software.

 

Also, from news.com and PC World.