Quickies and L0pht News

There have been a lot of things happening in the security world lately that I have wanted to write about like Geekonomics, the half million pictures pilfered from MySpace and the accompanying torrent file, how the NSA has wrestled control of the nations cyber-security away from DHS, how the recently proposed Protect America Act won’t, that Yahoo’s CAPTCHA has been cracked (not wide open but open enough), about Bruce Schnier’s excellent speech down under, how the Feds are getting rid of admin rights on XP boxes (about time) and of course about the CyberWar that wasn’t really. Like I said a lot of stuff going on recently to write about but I’ve just been to busy.

But what I really wanted to mention today was that the L0pht reuion I mentioned earlier seems to be becoming a pretty big deal. Did I mention the Pub Crawl?
P.S. Looks like the latest version of WordPress hosed some of my site. (Like the HNN archive) I’ll try to have it back online soon.

MS Security War Room

This is neat, sorta, Microsoft evidently has their very own Security War Room. Complete with snacks, a global clock and oooo, a motivational picture of Harvey Keitel! I suppose this sort of thing makes sense for governments but just how many security events does it take for your company to devote an entire room to them? At Microsoft it is evidently such a common occurrence that they haven’t just devoted one room to this purpose but two!

Who trusts you and who do you trust?

For some reason I am constantly reminded of the old Schwarzenegger movie Running Man where the game show host Damon Killian yells out “Who loves you and who do you love?” to rousing applause. Except when I think of that scene I often replace the word love with the word trust. They mean about the same thing don’t they?
So who do you trust? Do you trust your security consultants? ‘Acid’ or ‘AcidStorm’ (aka John Kenneth Schiefer) who worked for a Los Angeles based security consultant company known as 3G communications has pleaded guilty to purposely infecting computers he was supposed to be protecting with various forms of malware, running a botnet of 250,000 machines and even stealing paypal account passwords. Did I mention he was a security consultant?
And how about this, brand new Maxtor brand hard drives from Seagate are found to have Trojans preinstalled on them. What’s worse is that this has happened before (and will probably happen again.)
The bad guys aren’t lurking around corners hidden in dark alleys, they are right here in plain sight. So who do you trust? Who trusts you?

Bomb Threats from Google Hacking?

The worlds of physical and information security are quickly merging into one but people are still trying to take shortcuts.
By now most people have heard news reports about bizarre crimes where stores are receiving bomb threats over the phone and are forced to wire money to some unknown account or the store will get blown up. Evidently the anonymous caller convinces the store employees that they are being observed, makes them sit in a circle or take their clothes off and then wire the money. You can read about these crimes here, here and even here that are taking place across the country from Maine to Kansas.
So how is this possible? How can someone be observing store employees from outside the store? Some of the police officers in the above linked stories think it must obviously be the work of evil hackers who broke into the stores security systems over the Internet. I think it was said best by Hutchinson Kansas Police Chief Dick Heitschmidt when he said “If they can access the Internet, they can get to anything.” (Brilliant! Why is this man wasting his life in law enforcement?)
Actually Chief they don’t even need access to the whole internet, just Google. Take a look at these Google searches, like this one or this one. Those are default web pages for security cameras. Come on, you didn’t think people actually still used old VHS tape for those things anymore did you? It is all IP based and digital. Most people are just to lazy or stupid to setup a robots.txt page to even just change the default passwords. As a result the video feeds from the security cameras are available to anyone with a net connection.
So your criminal does a few Google searches, finds an interesting camera or two, figures out what store they belong to and then makes a phone call. Pretty simple, kinda surprised this hasn’t happened before now.
It is worse than that really. A lot of companies are connecting things like their electronic door card access systems, alarm systems and other security systems to the network. Bomb threats via telephone are what happens when they get access to the video cameras what would happen if they had access to everything else?
Just remember if you can access something over the net then the bad guys can to if they want to bad enough. The key is to make it hard for them, you can start by changing the default passwords.

iPhone Security Myths Busted

I know what your thinking, “Not more iPhone! Enough Already!” yeah, I know me to, but seriously there is just to much FUD floating around out there. FUD from reputable places such as Gartner. Well, OK maybe not that reputable but people still listen to them for some reason. They released a white paper last week telling IT Managers to avoid iPhone because it is insecure. What a load of rubbish.

The big complaints seem to be USB, IMAP and WiFi. Actuallly there is a lot more FUD floating around other than just that but I’m just going to focus on the security complaints.

Evidently the fear with USB is two fold, one that users can steal company secrets and two that users will fill up their machines with iTunes music. USB thumb drives and MP3 players have been around for, I don’t know, a long time now. USB mass storage devices can be disabled on both Windows and MacOS. If your IT department hasn’t figure out that these are threats by now you have much bigger problems than an iPhone.

For some reason WiFi is suddenly a new threat, or I guess it is only a threat when it is integrated into iPhone. How is this any different than a WiFi enabled laptop? As long as iPhone supports standard encryption protocols like WPA it is no better or worse off than a roaming laptop, at least for protecting your data in transit over the airwaves. For data stored on the device that is another issue. It is unknown if iPhone has a firewall of any sort to protect it from WiFi attacts. However, considering that iPhone is based on OSX which has a firewall built-in it is a pretty good bet that iPhone will have one as well.

OK, so now we have proper mass storage device controls in place, we have encrypted our WiFi and turned on the firewall what else could possibly be an issue? What’s that? email you say? Simple IMAP? IMAP is a security issue? Since when? Oh, I see your just so used to using MS Exchange and RIMs Blackberry Enterprise server you don’t know how to use anything else. Oh, by the way, MS Exchange supports IMAP. Of course you don’t get all the funky features with IMAP that you get with Exchange/Blackberry like being able to revoke all of a users email when you fire them. I suspect Apple will have some interesting iPhone features inside of Mac OSX.5 Leapord later this year.

About the only security questions I have with iPhone is wether or not it supports IMAP over SSL. or IMAPS. Considering that the iPhone has Safari built in I suspect that support for SSL will be included.

There are even some security features that will probably be in iPhone that haven’t been announced yet. Quick and easy firmware updates. You probably didn’t even realize it but iTunes will update your iPod firmware automagically with just the click of a button. It will be just the same with iPhone. If a problem develops Apple will just release a firmware patch that will automagicallly get applied the next time the user syncs. When was the last time you updated the firmware on your cell phone? Ever try to even look for a firmware update for your phone?

iPhone will run a modified version of OSX. That will likely include some form of FileVault, Apple’s encryption technology for user files. Thats right, encryption built right in. This hasn’t been announced and it might not be in there, but if the technology and the code already exist why not put it in?

iPhone looks to be just about as secure or even more so (no propritary and closed backend) than a Balckberry, Treo, or Blackjack. Everyone saying otherwise is either a paid MS schill, astroturfing, or just plain idiots.

Anti-Forensic Tools Evolving

Interesting article over at CIO about the current state of anti-forensic software. It talks about specific tools like Timestomp, Slacker, Sam Juicer, Data Mule and others whose sole goal in life is to frustrate the forensic analyzer and make it difficult for forensic tools like EnCase and others used by law enforcement. After reading this article you have to wonder if it is just a matter of bad guys (hax0rs) versus good guys (the p0-p0) or is it really just hacking tool versus forensic tool. A subtle but hugely important distinction.
Lets face it, most so called ‘hax0rs’ are nothing more than push button script kiddies running prepackaged tools against known vulnerabilities. Most forensic analysts spend $5,000 or so for a week long ‘ethical hacking’ course that teaches them how to be push button script kiddies running prepackaged tools against the afore mentioned script kiddies. He with the best tools wins. Which makes this really about the push button tools and not the hax0rs or the p0-p0.
The tools will obviously continue to evolve and one-up each other and the ‘hax0rs’ and the ‘experts’ will continue to push buttons. While the real hackers, researchers and analyzers will keep advancing the state of the art. (Personally I am waiting for that file system built inside the swap space.)

Hacking for Dollars $$$

iDefense just announced a bounty of $16,000 for remotely exploitable zero-day flaw in Apache, BIND, Sendmail, OpenSSH. IIS, or Exchange. This comes on the heals of the $10,000 plus a MacBook recently awarded by CanSecWest for remotely exploiting an OSX laptop.

While there are similarities between the two offers (not to mention iDefense and others standing bounty programs) both of these challenges raise the bar for spl0its. While $10K isn’t exactly chump change it is definitely worth a few days of banging away to find a hole in a system. In the case of iDefense’s latest offer of $16K many researchers are claiming that it is just not enough to motivate them to invest the work required to find such a hole in the listed software packages.

For the vast majority of researchers I suspect that this is true. The people capable of finding these holes all have jobs that pay at least five times that much if not more and if they don’t they should. $16K to them is probably chump change, at least compared to the effort and work required to find a viable exploit in these very robust packagaes.

However, I suspect that there are smart people elsewhere in the world for which 16,000 United States dollars might actually mean something. People who might be willing to put in the long hours and hard work required to find such a hole. If such a hole is found the question then becomes if it is worth only $16K or can they make more from it elsewhere? Think about it. A remote code execution vulnerability found in Sendmail, Apache or OpenSSH, what could you do with such a hole if not tied down by morals and ethics? Would you sell it for a measly $16K?

But really, sploits for dollars? Is that really the type of security model we should be promoting? Unfortunately the days of finding holes for sheer thrill, the glory, and the girliez seem to be far behind us. Is finding holes for a bounty any different than finding them for a salary?

The bigger question of course is disclosure. How holes are found isn’t as big an issue as what happens after they are discovered. Should the hole be disclosed or kept secret. If it is to be disclosed should there be a delay until a patch is available or announce immediately and leave unknowing people vulnerable? Should all holes even be patched?

Sploits for dollars. Maybe a new reality TV sports show?

Cyber UL

So why are there so many bad, nonsecure and just plain broken security products on the market? Should we depend on the unseen hand of the free market to allow the better products to bubble up to the top? Bruce Schneier’s recent column in Wired magazine shows that better products doen’t necessarily mean more secure products. Consumers would rather have an easy to use product instead of a secure product, in other words they want the dancing bears and chocolate. So products that have lots of blinking lights will win out in a free market over those that actually work. As Bruce mentions what is needed is some sort of label to let consumers know just how secure a product or service is. Sorta like the SPF rating on sunscreen, this way people can pick the level of security they need for thier environment. Bruce wrote about this before back in 2001 but the idea is much older than that. I first heard about such an organization that would rigoursly test and rate the security of products from Tan at the L0pht. He wrote and published a white paper waaay back in January of 1999 calling for a Cyber UL to test and rate security products.
So here it is over eight years later from that first call to action. Eight years. And we still have products like Secustick being released and used by the French Intelligence agency. Obviously there is a need for such an organization, where is it? Why hasn’t it been created yet?

Mac Hack Hype

So by now you have probably heard about the MacBook Pro that was compromised at CanSecWest last Friday. Here is a quick recap if you missed it. A MacBook Pro with all updates applied on a wireless network, if you can break in you win the laptop. Well, after two days no one broke in so the rules where relaxed a little and the MacBooks where allowed to surf to malicious webpages. You can read more details here, here, here, here, here, and probably a few dozen other places.
The hype on this is pretty amazing considering that this really isn’t that big of a hack. This sort of things happens on Windows platforms on a almost daily basis. Yes, its zero day but other than that so what? Lets take a look at the actual exploit, or at least as much as we can piece together from the various ‘news’ outlets. First you need to convince a user to visit your malicious web page with Safari (no mention if Firefox or other browsers are immune) which depending on who you are convincing may or may not be that hard. Then even after you get your code installed installed on the victim your only granted user level access. Your still not root. Granted your a big step closer to getting root but you are still mired in userland.
So yes, this is a valid hole that should be repaired as soon as possible but it doesn’t warrent anywhere near as much press as it has been garnering.