Mudge Cover’s Mass High Tech

So I get into work this morning and grab my snail-mail and throw it on my desk and go grab my morning oatmeal and glass of water. I get back to my desk and start eating my oatmeal as I go through my mail. Things like fake domain name renewal bills, pleas from wireless phone companies to switch services, a copy of Information Week, the normal crap that finds it way into the IT Managers inbox. Then I get to this weeks (August 22-28) copy of Mass High Tech and oatmeal spews out of my nose! Why? Freaking a big ass above the fold picture of Mudge’s fat smiling face staring back at me. Seriously his face takes up like half the damn page.

The online version is much smaller. Here is a scan of the front cover [PDF]. Just make sure you have finished your oatmeal before you open it.

Oh, the story? It is about finding security holes in heart defibrillators. Which is important I guess, and I suppose I would find it more interesting if I or someone I know actually had one of these implanted. Personally I can’t wait until someone starts looking at wireless utility meters.

More USB idiocy

I have written about really stupid USB security more than once but this has got to be the absolutely stupidest thing ever. (or if your the guy selling it I guess it is pure brilliance.) The previous USB security measures I wrote about claimed to be one thing and turned out to be another like using XOR when you claim to be using AES or just not using anything at all. In this case however there are no extravagant claims just a simple combination lock to physically lock your USB drive. A combination lock with only three digits, a combination lock that a three year old could probably open inside of five minutes. Granted this things only costs $7 but just how rock hard hard stupid do you have to be to use something like this even if it was free?

The Information Security Infantry

As a low-level, gravel crunching, grunt there are a few things that get drilled into your head through constant repetition, things like the only defense in an ambush is offense. If you’re caught in the middle of a well planned and executed ambush your pretty much dead so you might as well turn and run towards the hail of bullets coming at you and hopefully either run through them or scream loud enough to scare the guys shooting at you to stop shooting. Yeah, like I said, in an ambush your pretty much dead.

One of the other things that get drilled into your head is that obstacles must be kept under observation or they will be circumvented. You cannot spend all day in the hot sun setting up triple strand concertina wire and then walk away, the enemy will just cut through it. Sure it might slow them down for a while but it won’t stop them. However, if you’re standing there on the other side of the wire and the tanks come rolling along you will have more than enough time to call in the Warthogs before they can cut through the wire.

It is sometimes amazing to me how this simple principal of observation of obstacles is lost out here in the real world. Things like people installing a firewall and then never checking the logs. An attacker will bang on that firewall all day long until he finds a hole if he knows no one is watching. If you don’t observe your obstacles they will be compromised.

The folks over at Country Wide Home Loans evidently did not know of or understand his simple fundamental (to me anyway. Thanks Drill Sergeant!) security protocol. As a method to prevent dataloss by physical means they glued closed all the USB ports on their computers. Except evidently they forgot one machine. Of course the bad guy found this one machine and managed to siphon off personal information for 20,000 customers every week for two years!.

So an obstacle was put in place, the gluing closed of the USB ports, but there was no observation. No one checked the machines on a routine basis to see if rogue USB cards had been added to the system, no auditing of data transfer logs (assuming there were logs) for suspicious activity. No, just blind faith in super glue and the $14.00 an hour employee tasked with using the glue to get every single machine and not slack off early on a Friday afternoon.

Remember most security measures are just obstacles, all obstacles can be overcome given enough time and resources. Obstacles are nothing more than a deterrence, some obstacles are a bigger deterrence than others. So you can either run like a madman into the hail of bullets or keep your obstacles under observation.