Cybersecurity Newsbites: Be Careful Out There

Watching for Qaddaffi When Jodie Foster Was The Real Threat

Twenty five years ago I worked at the US Secret Service. I was in the Technical Development and Planning Division, now just part of the Technical Security Division. We were a group of 12 engineers that looked at and developed technology for the Secret Service's dual missions of fighting counterfeiting of US currency, and protecting the President, the Vice President (and their families), ex-President's, and foreign dignitaries when on US soil. We also did technical security advance trips, mostly bomb security, eavesdropping counter measures and really odd stuff - like elevator security and worrying about food poisoning or radiological hazards. We were not agents, we were not part of the protective details, we did not carry guns.

Twenty five years ago today I was in our office in Washington DC, where our secretary had a Motorola base station behind her desk so she could reach us if we were in any of the office cars that had radios in them. We also had a TV in our lunchroom, but in 1981 that was about the only real time communication beyond telephones that existed - we didn't have IM, email, etc. Even the TV only got the local broadcast channels - no CNN or any of the other 900 24 hour news channels we have today.

Our radio communications were on the channels we typically used, not the operational protection channels. The President, Ronald Reagan, was doing a local movement in DC - our office was not involved at the time. But that morning the secretary stuck her head in my office and said "hey, come listen to the base radio." I went to her desk and heard "We have Rawhide (Reagan's call sign at the time) at GWU hospital." Whoa!

It was the day Hinckley shot Reagan, and while I was in no way personally involved, it had long term implications for me.

After that, the focus of technology funding went way more towards ballistic armor and metal detectors - making up for deficiencies in fighting the last war. This is pretty standard organizational behavior in security, but in our office in USSS that meant I ended up getting completely consumed in flying around the world on bullet proof armor installations in every thing from Super Bowl sky boxes in Pontiac, MI to covered wagons in Hooper, UT. At first, kinda fun for a single 24 year old but really not where I had planned my career to go.

So, twenty five years ago that drove me to move from the USSS to GTE for a decade of building secure computer systems and it really, really made me realize how different physical security and information security are. It amazes me to see all the hype around "convergence" of those two areas when vendors or consultants talk about combined access cards or video surveillance systems over IP networks. That is no more convergence of physical security and information security than men's and women's bathrooms using the same plumbing is convergence of the sexes.

What is also amazing to remember is that at roughly the same time there was great angst coming from the intelligence community about Libyan hit squads that were being sent to the US to go after President Reagan and Vice President Bush. This caused all kinds of "homeland security" activity to take place that was never really made public. It was also about the same time that prior waves of airplane hijackings caused there to be metal detectors put in place at airports.

So, twenty five years ago we were thinking about terrorists and airplane hijackings - but still thinking about the last wave of attacks, fighting the last war against real, physical blood and death terrorism. I guess that is pretty much the signature of a free society - you have to react to threats and then overshoot on security at the expense of liberty, then back off. It ain't pretty, and it often feels like it doesn't work but over the long term it is inevitably the best approach compared to totalitarian central lockdown or individual anarchy.

What Goes Around, Never Goes Away

If you haven't read "The Cuckoo's Egg" by Cliff Stoll, you should. I read it years ago but I didn't have a current book to bring along with me on travel to Detroit, so I brought it along with me.

The events of the book took place just about 17 years ago this month. The Internet was a very different place, or was it? The events of the book are amazingly similar to what has been going on decades later: attackers use default passwords, misconfigured systems and vulnerabilities in common software to break into computer systems. Havoc ensues. As an epilogue to the book, Stoll talks about when the Morris Worm hit later in 1989 - the Morris worm impacted over 10% of the computers connected to the Internet, still the highwater mark for a worm.

Reading Cuckoo's Egg  again, I'm struck by how the only major area we have made progress in is Intrusion Prevention - we actually have ways to block many attempts to exploit misconfigurations and unpatched vulnerabilities, rather than just monitoring tools that say "oops, we were broken into." All of the system administration problems of 1989 are still problems today - and will likely be problems in 2023. Technology changes faster than operations units can react; budget pressures mean fewer skilled human hours per server/PC under management; increasing homogeneity means one mistake ripples across thousands of desktops and hundreds of servers. External security protection will be more important, not less.

PS -  I'm a UCONN alumnus but even I was cheering for George Mason!

Make Sure You Gird Your Grid

When the dopey (like a fox) kid who put up the million dollar home page got hit with a denial of service attack, I could understand - it was a wacky idea, done for fun. But when Sun  has the same thing happen to its much ballyhooed Grid service offering you have to wonder: What Were They Thinking??

Software as a Service means there will always be a network connection between the service and the consumer of the service. Any time that network is the Internet, if you don't build in denial of service protection you are a fool. That's ok for dopey college kids taking advantage of dopey people who will buy pixels, but, as salesforce.com learned, when you sell software as a service that is only available if no one tries to make it unavailable, you are taking square aim at your foot.

Sorry, Your Luggage Tag Took Your Suitcase to Samoa

It used to be that civilians checked their luggage while buisness travellers did carry-on. That all changed with the advent of the stupid  wheelie suitcase. Now, everyone carrys on except the oldest grandmas and folks with little kids. While most of the business travellers do it just for speed - or maybe just to hog overhead bin space - I think most of the civilians started doing carry-on due to horror stories of airlines losing luggage.

As a teenager, I worked summers at Kennedy airport in NY and just about every day we'd see bags bounce off of baggage carts and sit on the tarmac for hours, occasionally days. Did you ever notice how little we worry about paying minimum wage to those people who physically handle our most sensitive stuff? If you think about it, you really ought to pay someone Brad Pitt-level salaries to let them take sharp scissors and sharp razors to your scalp and neck...

Bar codes and automated luggage handling systems haven't changed that fear, but a new technology, RFID, will solve all the old problems, of course. Except, those pesky Dutch researchers have pointed out how easy it would be for badly designed RFID systems to spread malicious software - oops, my Louis Vitton luggage just sent your Kmart suit carrier to Flint, MI.

Now, the researchers did use a flashy title (RFID VIRUSES!!) and took a very public relations-savvy approach (rfidvirus.org?) but their basic point is valid: (1) if RFID tag programming systems are built without thinking about how malicious actors might exploit them; and (2) if RFID reader systems are built thinking "it is only static data on the RFID tag", then the probability of (3): someone exploits vulnerability in a tag programming system to insert specially formatted data on tags that exploits vulnerabiliies in the reader software is pretty much the same as the probability that the sun will rise in the east - at least 80%.

You can tell the probability is high by listening to the RFID industry's response - they sound just like web server vendors did six or seven years ago when vulnerabilities in how web servers worked were pointed out:

RFID industry: "Tags will only have data on them, not programs. RFID system don't work that way"

Web server industry: "Browsers only do what they are told. Web servers don't work that way."

Whammo - web servers assuming browsers would only pass back HTML lead to buffer overflow, command injection, SQL injection and hidden HTML tag attacks.

So, it is easy to design systems right to make sure that in a few years we just laugh about the overhype about RFID viruses, but if the RFID vendors stay in denial, airlines will have to let grandma and those young parents store their carry on bags up in the cockpit.

Security Assaults Our Batteries

There are two laptop-related technologies that don't seem to have made much progress in the past 20 years: keyboards and batteries. You can't blame QWERTY on security, but a CNET investigative report says you can blame your MP3 player's reduced battery life on security:

Those who belong to subscription services such as Napster or Rhapsody have it worse. Music rented from these services arrive in the WMA DRM 10 format, and it takes extra processing power to ensure that the licenses making the tracks work are still valid and match up to the device itself. Heavy DRM not only slows down an MP3 player but also sucks the very life out of them. Take, for instance, the critically acclaimed Creative Zen Vision:M, with a rated battery life of up to 14 hours for audio and 4 hours for video. CNET tested it at nearly 16 hours, with MP3s--impressive indeed. Upon playing back only WMA subscription tracks, the Vision:M scored at just more than 12 hours. That's a loss of almost 4 hours, and you haven't even turned the backlight on yet.

This tells us one of two things:

1. There will be a big market for low power, low cost  integrated circuits for decryption on portable devices
2. EverReady and Duracell will begin advertising campaigns on why DRM is good for you, have DRM your way, just say no to unprotected MP3s, etc.

Beware the March of the Integrated Development Environment

I really hadn't thought much further than the title - today is the Ides of March, which somehow Shakespeare knew would turn into a "legendary" band that no one ever heard of.

Integrated Development Environments can be good things from a security perspective - if Integrated means security analysis and testing are built in, too. Microsoft is doing some good stuff on threat modeling and other areas beyond the first major advance: building in ways (like prefix and prefast) to test code for known stupid programming tricks during development), other app vulnerability testing vendors, too. It's a start, need to see enterprises prioritize adoption before the Ides of December.

Shut Your Pi Hole

Who needs denial of service attacks when we can DoS ourselves on email threads?

   

---

From: nerd, sec
Sent: Tuesday, March 14, 2006 9:02 AM
To: bbb,ccc; DL ggg
Subject: RE: International Pi Day

Yes, on the way to driving my daughter to school today we had to stop and buy a pie. They did some kind of weighted selection - 1 of 8 kids had to bring in a pie, 7 of 8 bring in forks. I told my daughter that the pie kids would have to eat with their hands but 15 year old girls who have to get up even earlier to go to the bakery before school aren't very interested in factual observations.

---

From: aaa,bbb
Sent: Tuesday, March 14, 2006 9:07 AM
To: ccc,ddd; eee,fff; DL ggg
Subject: RE: International Pi Day

Both are wrong. If everyone used Year/Month/Date, it would be much easier to sort

---

From: ccc,ddd
Sent: 14 March 2006 14:03
To: eee,fff; DL ggg
Subject: RE: International Pi Day

That is a modern abberation according to Notes & Queries. You used to do it our way, and deviated for obscure reasons.

---

From:eee.fff
Sent: Tuesday, March 14, 2006 8:57 AM
To: bbb,ccc; DL ggg
Subject: RE: International Pi Day

Of course, in the UK, where we write dates dd/mm, we don’t celebrate π day until 22 July…

---

From: bbb,ccc
Sent: 14 March 2006 13:52
To: DL ggg
Subject: International Pi Day

Yes, 3.14 or 3/14, it is the annual Pi day and math departments all over the world will be celebrating. If your preference leans toward homonyms instead, have a nice dessert at lunchtime!

http://mathforum.org/t2t/faq/faq.pi.html

All The News That Fits, We Print

When I first moved to the Washington DC area, I really didn't know where to live - other than to minimize my commute to Ft. Meade. So, I moved to a small town called Savage, MD. It was midway between DC and Baltimore and I had the choice of getting the Baltimore Sun or the Washington Post. Both papers had "pay for Sunday, get the weekdays free" specials, so for a month I got both in order to figure out which one I should subscribe to.

(I wonder if kids fresh out of college even subscribe to print newspapers any more? Probably not - look at the circulation numbers of major papers. However, those same non-subscribing kids probably don't dangle participles at the end of sentences in their blog posts some 28 years after they graduate college... Now, back to our regularly scheduled programming.)

It was pretty interesting to see how differently the two papers handled identical stories. The Post is generally considered to have a liberal leaning, while the Sun (at least at the time) was considered conservative leaning. An anti-war or pro-abortion rally in DC or Baltimore that made the front page of both papers would have a very telling sign of that slant: the framing or cropping of the photo.

For a pro-abortion rally that had low attendance, the Washington Post would have a tight shot of a dense crowd of people holding signs, while the Sun would have a long shot showing a mostly empty site with a small knot of people up front. For a huge rally, the Post would use a long shot showing the immense crowd, while the Sun would use a tight shot of either counter-protesters, or some bored looking attendees. The actual facts in the story and the overall tone were usually pretty similar - but the editor's choice of the photo was telling.

Which brings me to a recent study funded by the IT Governance Institute and the choice of headlines by VNUNet on a story covering the results of the study. The headline of the VNU piece was:

"Security 'not a problem' for IT managers"

But when you actually read the study, you find that when asked what is the most important problem to address in the next 12 months, the number one CIO response was security - and security made the top three when CIO's ranked their problems by severity. It was only when asked about the past 12 months problems that security was at the bottom on the list. Compliance actually did drop down the list - it was *lowest* rated by CIOs in importance of addressing the problem. Good to see the recognition by CIOs that compliance does not equate to security, anyway.

The moral of the story is beware your news sources, because you may become them.

Do As We Say, Not As We Used to Do

Cute example of a variant of social engineering in an LA Times article, and out in blog land.  (Thanks to alert readers KK and GY) However, it still doesn't rank anywhere near the best sports event hoax ever: the great Rose Bowl prank of 1961.

However, those wacky, studly MIT guys have come close.

Hacking is pretty much fun, isn't it? As responsible grown ups we have to pretend it isn't, though.

Instead, we have to tell our kids about the spunky Southern Illinois cheerleader who kept cheering even after damaging vertebrae after falling from the top of a cheerleader pyramid, and tsk tsk about irresponsible people finding ways to fling water balloons more than 100 feet.

ABBA: Crappy Band, Rhyme Scheme, or Internet Attack Predictor?

'Cause he's the man in the middle
never second fiddle
just like a spider in a cobweb
Hard as a hammer
not the kind of boss -
you double cross

 
'Cause he's the man in the middle
knows the way to diddle
he's never bothered by his conscience
Deals with the devil
'cause he wants to be
man in the middle, the middle, the middle
in the middle

Four or five years ago, a colleague and I wrote a research note called "Secure Sockets Layer Sometimes Isn't." The point back then was that commercial certificate authorities were starting to compete on price for SSL server certificates (the only real SSL certificate market) and were automating the registration process to be able to make money at low prices.

Now, the theory behind using public key certificates as part of SSL was that not only would using SSL from a consumer's browser to a business's server cause the bits in motion to be encrypted but it would give the consumer some assurance that they were talking to a legitimate business - and to the business they thought they were talking to. But, if anyone could buy a certificate claiming to be a legitimate business, all that assurance goes down the drain. So, pretty much for all its life SSL has been nothing but transport encryption - protecting against a threat (data sniffing over the Internet) that really doesn't exist.

Actually, that's a bit harsh - in the mid 90's, before SSL became widespread, we did see sniffers installed at ISPs. Transport security during login did blunt that threat - but the overuse of "look for the blue lock" to give consumers confidence in giving out sensitive information online definitely enabled phishing type attacks. Now there is a good piece in InfoWorld on some SSL malware being found on corporate servers which redirects legitimate connect attempts - basically a Man In the Middle malware package that takes advantage of the lack of anything beyond transport security in SSL.

So, it is good to see all the browser makers and all the certificate sellers agreeing to enable the use of high assurance certificates on both ends of the SSL equation. But (and this is a big but), high assurance certificates will be meaningless is the goal is simply to move all liability to the consumer end - IE, if the goal is simply to give the browser user more mechanisms to see the details of the certificate. At a higher price per certificate, there are many ways CAs can actually protect consumers by making the "high assurance" part real. But the danger is seeing high assurance certificates be nothing but higher cost certificates.

The missing browser mechanisms seem to be falling into place, now we need to see the Certificate Authorities agree to standards of practice for registration processes and assurance levels for High Assurance Certificates.