Well it looks there may be a mini reunion of old L0pht folks. We are still trying to round everyone up but there will more of us together on one stage than there has been for over ten years. (Damn, has it really been that long?) Anyway it will be at the Source 2008 conference in Boston in March. There are some other pretty damn big heavy hitters who will also be at the conference, Steven Levy (yes, of Hackers the book), Dan Geer (yes, of Athena), Richard Clarke (yes, that Richard Clarke). Not sure what day yet the L0pht panel will be speaking but it will be one hell of a conference.
This is neat, sorta, Microsoft evidently has their very own Security War Room. Complete with snacks, a global clock and oooo, a motivational picture of Harvey Keitel! I suppose this sort of thing makes sense for governments but just how many security events does it take for your company to devote an entire room to them? At Microsoft it is evidently such a common occurrence that they haven’t just devoted one room to this purpose but two!
12 11 2007
For some reason I am constantly reminded of the old Schwarzenegger movie Running Man where the game show host Damon Killian yells out “Who loves you and who do you love?” to rousing applause. Except when I think of that scene I often replace the word love with the word trust. They mean about the same thing don’t they?
The worlds of physical and information security are quickly merging into one but people are still trying to take shortcuts.
Once in a great while a technology reporter seems to ‘get it’ and publishes an acurate article without the FUD and fear mongering that usually accompanies a security related news item. When that happens it should be recognized. Take a moment and read “Middle Amercia, Meet the True Hackers” by Andy Greenberg at Forbes.
So the folks over at Independent Security Evaluators claim to have found a remote iPhone exploit. Evidently this is big news as it has already garned an article in the New York Times (talk about media whoreing) and been granted a coveted speaking spot at the Blackhat Security Briefings early next month. Must be a pretty bad spl0it to get all this attention, right? Doesn’t sound like it, more like they were just the first folks to find a decent sized hole.
Sure there have been other holes found, like figureing out how to change the color of your charging battery from green to neon pink or bright blue, or managing to hack in a custom ringtone or the big one of being able to bypass the AT&T activation but still be able to use the phone. These are all kind of rinky dink holes though, nothing that puts your personal data at risk. This new hole claims to do just that.
According to the folks at Independent Security Evaluators thier proof of concept code can read the log of SMS messages, the address book, the call history, and the voicemail data. Pretty damning stuff to be sure. So why is this not a big deal?
First of all the delivery method is little convoluted and requires some social engineering to convince the user to visit a compromised web page or to use an untrusted wireless network. These are the same attack vectors that plaque laptops and other PDAs, nothing new here. What is new is that this effects an iPhone, that is why it is getting the press. I also suspect that this will be pretty trivial to fix. From the details that have been released so far I suspect that just by altering iPhone’s Safari to prompt the user when downloading and running applications should do the trick.
So basically continue safe computing practices, don’t be complacent and don’t put to much trust in your devices and you’ll be fine. Vulnerabilities that require user interaction like this one aren’t what you should be worrying about, attacks that compromise entire cell sites and infrastructure like the one that hit the Greece Olympics or the hack that hit Paris Hilton are what should be keeping you awake at night.
I know what your thinking, “Not more iPhone! Enough Already!” yeah, I know me to, but seriously there is just to much FUD floating around out there. FUD from reputable places such as Gartner. Well, OK maybe not that reputable but people still listen to them for some reason. They released a white paper last week telling IT Managers to avoid iPhone because it is insecure. What a load of rubbish.
The big complaints seem to be USB, IMAP and WiFi. Actuallly there is a lot more FUD floating around other than just that but I’m just going to focus on the security complaints.
Evidently the fear with USB is two fold, one that users can steal company secrets and two that users will fill up their machines with iTunes music. USB thumb drives and MP3 players have been around for, I don’t know, a long time now. USB mass storage devices can be disabled on both Windows and MacOS. If your IT department hasn’t figure out that these are threats by now you have much bigger problems than an iPhone.
For some reason WiFi is suddenly a new threat, or I guess it is only a threat when it is integrated into iPhone. How is this any different than a WiFi enabled laptop? As long as iPhone supports standard encryption protocols like WPA it is no better or worse off than a roaming laptop, at least for protecting your data in transit over the airwaves. For data stored on the device that is another issue. It is unknown if iPhone has a firewall of any sort to protect it from WiFi attacts. However, considering that iPhone is based on OSX which has a firewall built-in it is a pretty good bet that iPhone will have one as well.
OK, so now we have proper mass storage device controls in place, we have encrypted our WiFi and turned on the firewall what else could possibly be an issue? What’s that? email you say? Simple IMAP? IMAP is a security issue? Since when? Oh, I see your just so used to using MS Exchange and RIMs Blackberry Enterprise server you don’t know how to use anything else. Oh, by the way, MS Exchange supports IMAP. Of course you don’t get all the funky features with IMAP that you get with Exchange/Blackberry like being able to revoke all of a users email when you fire them. I suspect Apple will have some interesting iPhone features inside of Mac OSX.5 Leapord later this year.
About the only security questions I have with iPhone is wether or not it supports IMAP over SSL. or IMAPS. Considering that the iPhone has Safari built in I suspect that support for SSL will be included.
There are even some security features that will probably be in iPhone that haven’t been announced yet. Quick and easy firmware updates. You probably didn’t even realize it but iTunes will update your iPod firmware automagically with just the click of a button. It will be just the same with iPhone. If a problem develops Apple will just release a firmware patch that will automagicallly get applied the next time the user syncs. When was the last time you updated the firmware on your cell phone? Ever try to even look for a firmware update for your phone?
iPhone will run a modified version of OSX. That will likely include some form of FileVault, Apple’s encryption technology for user files. Thats right, encryption built right in. This hasn’t been announced and it might not be in there, but if the technology and the code already exist why not put it in?
iPhone looks to be just about as secure or even more so (no propritary and closed backend) than a Balckberry, Treo, or Blackjack. Everyone saying otherwise is either a paid MS schill, astroturfing, or just plain idiots.
Interesting article over at CIO about the current state of anti-forensic software. It talks about specific tools like Timestomp, Slacker, Sam Juicer, Data Mule and others whose sole goal in life is to frustrate the forensic analyzer and make it difficult for forensic tools like EnCase and others used by law enforcement. After reading this article you have to wonder if it is just a matter of bad guys (hax0rs) versus good guys (the p0-p0) or is it really just hacking tool versus forensic tool. A subtle but hugely important distinction.
iDefense just announced a bounty of $16,000 for remotely exploitable zero-day flaw in Apache, BIND, Sendmail, OpenSSH. IIS, or Exchange. This comes on the heals of the $10,000 plus a MacBook recently awarded by CanSecWest for remotely exploiting an OSX laptop.
While there are similarities between the two offers (not to mention iDefense and others standing bounty programs) both of these challenges raise the bar for spl0its. While $10K isnâ€™t exactly chump change it is definitely worth a few days of banging away to find a hole in a system. In the case of iDefense’s latest offer of $16K many researchers are claiming that it is just not enough to motivate them to invest the work required to find such a hole in the listed software packages.
For the vast majority of researchers I suspect that this is true. The people capable of finding these holes all have jobs that pay at least five times that much if not more and if they don’t they should. $16K to them is probably chump change, at least compared to the effort and work required to find a viable exploit in these very robust packagaes.
However, I suspect that there are smart people elsewhere in the world for which 16,000 United States dollars might actually mean something. People who might be willing to put in the long hours and hard work required to find such a hole. If such a hole is found the question then becomes if it is worth only $16K or can they make more from it elsewhere? Think about it. A remote code execution vulnerability found in Sendmail, Apache or OpenSSH, what could you do with such a hole if not tied down by morals and ethics? Would you sell it for a measly $16K?
But really, sploits for dollars? Is that really the type of security model we should be promoting? Unfortunately the days of finding holes for sheer thrill, the glory, and the girliez seem to be far behind us. Is finding holes for a bounty any different than finding them for a salary?
The bigger question of course is disclosure. How holes are found isn’t as big an issue as what happens after they are discovered. Should the hole be disclosed or kept secret. If it is to be disclosed should there be a delay until a patch is available or announce immediately and leave unknowing people vulnerable? Should all holes even be patched?
Sploits for dollars. Maybe a new reality TV sports show?
So I wrote about the article in CSO Magazine by Michael Fitzgerald earlier this month when the print version came out. Finally it is now online for easy reading by all you non-subscribers. Previous Works sysop Jason Scott of Admin-D and Textfiles.com fame has written a rebuttal/commentary/analysis of the piece.