HackerCode

Clinton cybersecurity speech misses the mark on privacy

In case you didn't catch Clinton's address on cybersecurity last night, I'm imbedding it here:

Generally, she's saying the right things -- an open and uncensored Internet is a tremendous force for good in the world. She should also be addressing net neutrality in this context, but I can understand that she didn't want to broaden her scope too much.

Then, a couple of minutes in, she says this:

Now, all societies recognize that free expression has its limits. We do not tolerate those who incite others to violence, such as the agents of al-Qaida who are, at this moment, using the internet to promote the mass murder of innocent people across the world. And hate speech that targets individuals on the basis of their race, religion, ethnicity, gender, or sexual orientation is reprehensible. It is an unfortunate fact that these issues are both growing challenges that the international community must confront together. And we must also grapple with the issue of anonymous speech. Those who use the internet to recruit terrorists or distribute stolen intellectual property cannot divorce their online actions from their real world identities. But these challenges must not become an excuse for governments to systematically violate the rights and privacy of those who use the internet for peaceful political purposes.[Full text of the speech here]

So, privacy, anonymity, and an open economy of ideas is good except when our enemies have it? Despite all of the rhetoric to the contrary, I don't think she really wants a free Internet. She just wants an Internet that promotes US best-interests.

Considering some of the electronic surveillance actions our government took after 9/11, adminishing China is a little bit of the pot calling the kettle black. I was hoping that we'd also take this opportunity to embrace these ideas domestically as well as promoting them overseas.

Embracing a free exchange of information means embracing the exchange of dangerous and radical ideas along with the popular and prosperous ones. You cannot selectively grant privacy and anonymity -- either you support it or you don't.

Secure web form authentication using stored procedures

This is a posting I've been planning to do for several months but am just finding time for. One of the most common questions I get from developers is how they should be handling authentication. My advice is always the same - don't. I have no idea why developers want to be custodians of data as sensitive as a username and password when there are federated identity providers such as OpenID that will accept that risk on the developer's behalf.

Some developers insist on localized identity management, so the next couple of posts are going to illustrate how they can implement web forms securely using MySQL stored procedures and UUIDs to insulate them from the risks storing credentials.

Before getting to code-level specifics, let's define the problem we're solving.

First, we want to make sure that a single user's credentials cannot be discovered via SQL injection or other application-level security flaws. Most developers mitigate this by only storing one-way hashes of passwords.

Second, because hashes are susceptible to rainbow tables attacks, we want to make sure that an attacker cannot obtain any aggregated credential hashes. Keep in mind that many users utilize the same (or similar) passwords across many system. This means that aggregated credential hashed are extremely valuable to an attacker. To mitigate this, we will check authentication within a stored procedure. If the password hash is checked via a stored procedure and the application user only has execute permissions, an attacker cannot extract aggregated credentials even if they completely control an application.

Finally, we want to make sure that an attacker cannot easily mine your database for aggregated private or sensitive data through application-level flaws. By using a UUID as the primary key instead of a username or canonical index, we make it very difficult for an attacker to extract data for a single arbitrary user; this also makes data aggregation more difficult.

That's probably as clear as mud, so I'll explain via code examples. The principals all apply no matter what platform you're on, but the examples are all using MySQL 5.1.x.

Original Mac Pro and 64-bit BootCamp

Apple really screwed the pooch on this one. I own an original Mac Pro -- it's been a fabulous machine and is still screaming fast three years later, but it will only recognize two gigs of RAM running 32-bit Vista. This isn't a Windows thing, mind you, it's a limitation in the Mac firmware.

So, this morning, after doubling the RAM in my machine, I decided to upgrade to 64-bit Vista. The problem is, Apple doesn't support it -- see here.

Not only do they cripple 32-bit RAM support in the firmware, but they don't support 64-bit installation on my machine. It doesn't sound like interoperability is really a goal in Cupertino.

The Apple support forums weren't helpful, so after searching, I found a solution on MSDN of all places. The thread deals with installing HyperV, but it works for Vista as well.

All you have to do is boot into Windows,  copy the contents of the Vista install DVD to a temporary location, and use oscdimg.exe from the Windows Automated Installation Kit.

Security lessons from behavioral economics

Ted has posted another fascinating talk, this time by behavioral economist Dan Ariely. The talk is essentially about how context and complexity can influence decision-making contrary to what one would generally call a rational process.

While interesting in its own right, this analysis could have an immense effect on security. In it's simplest form, OpenBSD understood this years ago with "secure by default" -- make insecure configurations more difficult than secure configuration and systems will, for the most part, be configured properly.

One can take this a step further and apply it to user interface design. Internet Explorer 8 does this with SSL errors -- the user is steered towards not viewing a site instead of blindly clicking through to a potentially hostile page.

Human error is the single largest vulnerability out there. Instead of looking at security as the enemy of usability, there could be a significant security gain by engaging our usability experts to guide users into making smarter decisions about security.

 

 

TSA doesn't believe in insider threats

Dave Lewis at Liquid Matrix has pointed out an article from Denver 9 News. Apparently, TSA employees no longer have to go through security when reporting to work -- they are allowed to take backpacks purses, and other personal items into secured areas without inspection.

From Denver 9 News:

The TSA says the new policy is part of a risk-based security screening process where there are multiple layers of security

"We have a finite amount of resources and we allocate those where we think the risk is greatest," said Harmon. "It's based on intelligence; it's based on knowledge of our people and our processes."

The TSA says its employees have background checks before they are hired. TSA policy says employees are supposed to report any other arrest, including an alcohol related arrest, within 24 hours or, due to circumstances beyond their control, as soon as possible after that. [From 9NEWS.com | Colorado's Online News Leader | Airport screeners bypassing security]

Most companies vet their employees as part of the hiring process as well -- the TSA isn't unique there. I certainly had to go through a background check before starting my current position. In my position, secured areas are electronic rather than physical, but the general principals still apply.

I don't have unfettered access to secure areas. There are still access controls, audits, and policies that manage my access. In short, the access rules are designed to minimize insider threats.

Yes, inside attacks are much rarer than external attacks, but the impact is far more severe when the attacks do occur. The insiders know exactly where the valuable targets are and how to exploit them.

Insider threat is real, and TSA has an easy win available to them to -- a policy decision to make employees go through existing security check points.

UCSB team develops voting machine virus

The Computer Security Group at the University of California Santa Barbara have done an in-depth look at the voting machines used by the State of California and have authored a proof of concept virus.

From UCSB:

In the Summer of 2007, the Security Group of UCSB participated in the Top-To-Bottom Review (TTBR) of the electronic voting systems used in California. This was a first-of-its-kind review, where the evaluators had unprecedented access to the systems' source code, hardware, and associated documentation.

* * *

In particular, we developed a virus-like software that can spread across the voting system, modifying the firmware of the voting machines. The modified firmware is able to steal votes even in the presence of a Voter-Verified Paper Audit Trail (VVPAT). [From UCSB: Evaluating the Security of Electronic Voting Systems]

There are currently three publications around this research. A report, a formal paper, and a video.

Here is the video (in two parts):

 

Part One

 

Part Two

Cybercrime first: space station virus

Apparently, NASA is sending unclean builds into orbit leading to a first -- a space worm.

From hungry-hackers.com:

SAN FRANCISCO: NASA confirmed that a computer virus sneaked aboard the International Space Station only to be tossed into quarantine on July 25 by security software.

A "worm type" virus was found on laptop computers that astronauts use to send and receive email from the station by relaying messages through a mission control center in Texas, according to NASA spokesman Kelly Humphries on Wednesday. [From Computer virus goes into orbit | Hacking Truths]

The Dark Visitor blog suggests that the worm is Chinese in origin:

The trojan is also referred to as the kavo.exe virus and is designed to gather information on ten online games:

ZhengTu
Wanmi Shijie or Perfect World
Dekaron Siwan Mojie
HuangYi Online
Rexue Jianghu
ROHAN
Seal Online
Maple Story
R2 (Reign of Revolution)
Talesweaver

* * *

Will check more into the origin of this malware later today but all indicators suggest that it could be Chinese. [From The Dark Visitor » Chinese hacker malware infects International Space Station?]

While it may be Chinese, I'm betting it isn't an intentional attack. Unless, of course, Chinese and Korean MMOGs are popular on the space station.

Chinese ISP suffers DNS poisoning

Following the AT&T DNS poisoning late last month, one of China's largest ISPs, China Netcom, has suffered a similar setback. In the past, Chinese companies have had little trouble with information security as their domestic hackers primarily target foreign servers. This is starting to change, however, and China is going to have a huge problem trying to both maintain security and continue the fast pace of growth.

From ZDNet Blogs:

The DNS server of one of China's largest ISPs has been poisoned to redirect typos to a malicious site rigged with drive-by exploits.

According to a warning from Websense Security Labs, the DNS poisoning attacks are affecting customers of China Netcom (CNC) and are using a malicious iFrame to launch exploits for known vulnerabilities in RealNetworks' RealPlayer,  Adobe Flash Player and Microsoft Snapshot Viewer. [From ZDNet: Websense reports China Netcom DNS cache poisoning]

New Windows vulnerability spotted in the wild

A Windows new remote-code execution vulnerability has been spotted in the wild. A proof-of-concept demonstration is available here.

From CyberInsecure:

a new public zero-day Windows vulnerability is being exploited in the wild. Microsoft Windows is prone to a remote code-execution vulnerability due to an unspecified error in 'NSlookup.exe'. Successfully exploiting this issue would allow the attacker to execute arbitrary code on an affected computer. Failed attacks will cause denial-of-service conditions. Microsoft Windows XP Professional SP2 is vulnerable; other versions and products may also be affected.

According to the alert, the issue is being actively exploited in the wild but details on the attacks are currently unavailable. At this moment there are no workarounds or vendor-supplied patches [From CyberInsecure:Zero-day Microsoft Windows NSlookup.exe Vulnerability Exploited In The Wild]

Technorati Tags: microsoft,windows,vulnerability,exploit

Apple users targeted by phishing scams

It looks like glitches in Apple's MobileME rollout and the accompanying user frustration have created opportunities for phishing scams. I think Apple has already burned through their security goodwill. It's time for the company to step up and start dealing with the rapidly emerging threat that targets its customers.

From The Register:

Data obtained by CardCops, a credit card protection service owned by the Affinion Group, shows sensitive information belonging to several hundred people with Mac.com email addresses being traded in underground forums frequented by identity thieves. The details include social security numbers, birth dates, mothers' maiden names, credit card numbers and other sensitive information.

The graphic to the right, which has been edited to remove personally identifying details, shows some of the data that's been available.

The information was phished using emails that began circulating around the same time Apple began its ill-fated transition from Mac.com to Me.com. The scams bore subjects such as "Billing problem." Following the link as recently as Tuesday while using Apple's Safari browser, we were taken to an authentic-looking page purporting to belong to Apple. It asked users to reinstate their accounts by entering a dizzying array of personal details. (Interestingly, while Internet Explorer warned us the page was a scam, neither Safari nor Firefox flagged it.) [From The Register: Apple faithful snared in phishing scam targeting Mac.com users]