Spliced feed for Security Bloggers Network |
| Security Catalyst Community: discussion forum activity for July 7, 2008 [The Security Catalyst] Posted: 07 Jul 2008 05:00 AM CDT As we roll into Monday (and after a holiday weekend in the US), there are several interesting posts ready for your comments, and plenty of insight to make your week even easier! Take a look at:
Join the in the Discussion! Your participation is your currency (means no charge to join) - the more you contribute the more you learn and the more valuable the community becomes to everyone (so dive in and share). If you have not yet registered, please remember to use firstname.lastname as the standard. |
| The Evolution of Penetration Testing [spylogic.net] Posted: 07 Jul 2008 05:00 AM CDT  Last week GNUCITIZEN posted an article entitled "Tiger Team Operations vs. Penetration Testing". I personally feel this is a spot on article and is a must read for anyone involved in either tiger team operations or penetration testing. The article focused on three areas in regards to these two types of assessments: quality, pricing and time frames. While these three areas are quite different when comparing a tiger team operation vs. a penetration test I see something more when it comes to penetration testing. I see the penetration test as we know it eventually evolving into tiger team operations. While we will always need to conduct traditional network and web application penetration tests, clients and employers are asking us to conduct more "unique" assessments. These unique types of assessments include things like social engineering, client-side phishing, physical security reviews, user security awareness, or testing the overall security of a specific facility or business unit. These unique individual assessments are addressing the changing threat landscape and new ways information systems and people are being exploited. A tiger team can address many of these different types into one unique assessment of it's own (including network and web application penetration when appropriate). Keep in mind, a tiger team operation is very different then a penetration test in terms of quality and quantity as GNUCITIZEN mentions. A tiger team requires multiple unique skill sets (for example a physical security specialist) and always requires multiple high performance team members. Let's also not forget about timing and preparation. A tiger team operation and a penetration test should always be conducted unannounced and to conduct the operation properly the team must be held to strict confidentiality. In regards to preparation, a tiger team operation may take many weeks and/or months to prepare. Why so long? The longer preparation time (meaning the reconnaissance phase) the closer you will get to simulating an actual attack on the targets selected. The real bad guys that want to do harm to your organization have the advantage of time...a tiger team must try to replicate this as close as possible. There may also be variations of a tiger team operation as well. Some methods may or may not need to be used depending on the scope and the target(s). I am currently putting together a presentation for a conference later this year on how tiger team assessments work in a large corporate environment and how you can take these same concepts and use them either with an internal penetration testing program or for clients. More on this in the coming weeks. In the meantime, if you want to know what a tiger team operation/assessment is like...I recommend you check out the Tiger Team series that was on TruTV last year. You can find torrents and also view one of the episodes on the TruTV web site. |
| Mind the Storefront! [Branden Williams' Security Convergence Blog] Posted: 06 Jul 2008 06:30 PM CDT Dave Taylor has another guest post on StoreFrontBackTalk, this one alluding to a lack of audit resources to mind the storefront (like Minding the Gap!). Store front security continues to be an issue for retailers even outside of PCI. Take physical security for example. Realize that a major retailer's data center tends to be a hardened facility that is not easily accessed (with the exception of a few notable ones that are for another post). There are security guards, badged access, and sometimes even man traps. Now visit that same retailer's store front. You might find accessible Ethernet jacks, or worse, a system room door that is unlocked or left wide open. Walk into there with an official ID and you might just jack in to that same VLAN or security level as if you jumped through all the hoops at the data center! The point that Dave makes is the same one I'll make here. There are two things that will greatly mitigate the risks associated with weak physical security in the stores.
Companies that treat their store networks as trusted are fooling themselves. Those networks are either already hacked, or could easily be hacked (even if you ignored the obvious insider threat!). End to end encryption is a best practice for PCI (and in my opinion, it should stay that way for now), but it is definitely an example of layered security on top of compliance that will greatly increase a company's resistance to a breach. |
| Security Catalyst Community Blogrolling [The Security Catalyst] Posted: 06 Jul 2008 05:51 PM CDT I took some time today to validate the blog and podcast members of the Security Catalyst Community (SCC). The SCC was established to serve the needs of all bloggers, podcasters and professionals to have a common place to come together and share ideas. As the community grows, more voices representing different experiences and perspectives work to enhance the benefit for those who participate. Here is the list of voices, active in the community (more than 5 posts), that work to enhance the overall community experience. We have over 30 members who are bloggers and podcasters! You can view the full list here: What Security Blogs and Podcasts are represented in this community? This explains the growing quality of the discussions, ideas, insights and solutions being shared on a daily basis! Note: if you are a current community member and are not listed, please send me an email or private message and I’ll be certain to get you included. The Security Catalyst (Michael Santarcangelo) | http://www.securitycatalyst.com Please take a moment to visit some of these resources to read their thoughts, and then come participate in the discussion at the Security Catalyst Community. Join Us! Your participation is your currency (means no charge to join) - the more you contribute the more you learn and the more valuable the community becomes to everyone (so dive in and share). If you have not yet registered, please remember to use firstname.lastname as the standard. |
| Article Review: Security Features on Switches [Security Karma] Posted: 06 Jul 2008 10:08 AM CDT InformIT: Security Features on Switches > Securing Layer 2 There are many layer-2 security features available but unfortunately in a large dynamic environment they are typically difficult to deploy. Chapter 2 from Network Security Technologies and Solutions (CCIE Professional Development Series) book by Cisco Publishing gives the reader a rundown of all the technologies at your disposal (when using a Cisco Catalyst switch of course!). What did I learn? Being a former switch jockey myself (and being security conscience of course) I was pretty familiar with most of the topics covered in this chapter. However, that isn't to say I know everything and there were definitely topics that I was either unfamiliar with or learned more about while reading.  The port-level controls is standard fair with a new twist (for me) I hadn't heard of the Protected Ports (PVLAN Edge) feature with basically prevents ports within the same VLAN from communicating with each other. This feature would allow you to forgo VLAN-ACL's if you didn't want any communication between ports to occur.  The rest of the chapter is spent on some of the lesser-known security controls available to network and security professionals. DHCP Snooping, Dynamic ARP Inspection, and Control Plane Policing (CoPP) are just a few of the subjects covered. Pretty paranoid stuff and most likely not deployed in most of your larger, non-ISP shops (in my experience, YMMV). The article also gives us a list of best practices to follow for effective L2 security. I will list a few of these best practices but I recommend you click on the link above and read the article yourself as you will most likely learn something interesting and useful.
|
| Grave Robbers Hit Montgomery Ward For Up To 200K Credit Card Numbers [Security Karma] Posted: 06 Jul 2008 09:08 AM CDT  The AP is reporting that the online-retail store Montgomery Ward was breached back in December with between 51,000 to 200,000 credit card numbers, expiration dates, and CVV2 numbers. Details of the breach aren't widely known and it wasn't reported whether Direct Marketing Services [DMS], the company that purchased the Montgomery Ward name out of bankruptcy, was PCI DSS compliant. None of that information is that troubling to me however. Breaches happen. We learn from them (hopefully) and move on. What irks me about this one is that DMS didn't notify their customers after the breach occurred. Since the penalties for non-disclosure are far less (non-existent in some cases) than the costs associated with replacing credit cards and monitoring up to 200,000 credit reports DMS did what companies do best: Act in their own self-interest, watch the bottom line, and hope nobody finds out. Obviously there is no easy solution to this problem. DMS followed guidelines and notified banks of the breach. However, it is not mandated that the bank notify a customer that their information was potentially compromised. Disclosure is left up to the merchant that was originally hit and will ultimately pay for any and all costs associated with replacement of cards and monitoring of accounts. Unfortunately, this is a case where the private market will not lead to an efficient outcome. Legislation is needed in order to hold companies accountable for the non-disclosure of private and financial information breaches. We will see proper disclosure of breaches when we start walking CIO's and CEO's out of headquarters in handcuffs and making the fines high enough to make full disclosure seem like a bargain. I hope companies start doing the right thing by their customers but I, for one, will hold my breath. |
| Do Not Mobilize My Personal Data [ImperViews] Posted: 06 Jul 2008 05:23 AM CDT At least not to an unencrypted laptop device... The 2nd quarter of 2008 demonstrates the absurdity of a few lost/stolen laptops affecting thousands of people. Laptops that stolen from Hospitals , Banks, Schools, and government organizations, contained unencrypted private data of thousands of people (employees, former employees, students, clients, patients). "The computer is password protected" is no longer an acceptable argument to relieve the affected people. Organizations still are not stepping up to their responsibility to govern the data, and to minimize the damage caused by the loss of laptops. Take the Stanford University case as an example: 62,000 current and former Stanford employees are affected by this theft. The laptop contained their name, address, phone number, and SSN. Why? Well, according to Stanford's announcement the relevant table was erroneously copied to the laptop. The University mentioned that its information security policies and guidelines disallow storing unencrypted sensitive data on any unprotected system. This is a pretty restricted policy, but obviously its implementation is not audited. With today's database activity monitoring and security solutions, It is possible to restrict the types of activities users perform with sensitive data without completely denying access to this data. After all, it is not enough to have a policy that forbids storing of unencrypted data on laptops, but cannot prevent it or at least issue an alert when data is jeopardized. Effective controls can actually detect the move of sensitive records or entire tables across the enterprise and in particular onto end-stations (not to mention mobile ones), giving the organization a heads-up before mishaps take place. AT&T stolen laptop is the same story, different organization. Again the data on the stolen laptop included names and SSN of AT&T employees. The data was not encrypted, and AT&T declares that this is a violation of its policy. But why they are aware of this violation only after the laptop was stolen? On both incidents the organization claim to have detailed accurate information of the data that was on the laptop, so we can assume that they do have some auditing on their database. Unfortunately, their audit trail does not give them real ability to govern the database on real time, and enforce their security policy. It is only a damage control system that functions after the damage has been done. |
| Posted: 05 Jul 2008 10:36 PM CDT This is a non-security post… I did not get a lot of work done Thursday afternoon. I was shopping. Specifically, I am shopping for a new laptop. I have a four year old Fujitsu running XP. The MTBF on this machine is about 20 months, so I am a little beyond laptop shelf life. A friend lent me a nice laptop with Vista for a week, and I must say, I really do not like it. Don’t like the performance. Don’t like the DRM. Don’t like the new arrangement of the UI. Don’t like the lowest-common-denominator approach to design. Don’t like an OS that thinks it knows what I want and shoves the wrong things at me. The entire direction it’s heading seems to be the antithesis of fast, efficient, & friendly. So what to buy? If you do not choose Windows, there really are not a lot of options for business laptops. Do you really have a choice? I was reading this story that said Intel had no plans to adopt Windows Vista for their employees. Interesting that this comes out now. Technically speaking, the Microsoft “End of Life” date for Windows XP was June 30th. I sympathize with IT departments, as this makes things difficult for them. I am just curious what departments such as Intel’s will be buying employees as their laptops croak? With some 80,000 employees, I am assuming this is a daily occurrence, so I wonder how closely their decision-making process resembles mine. I wonder what they are going to do. Reuse XP keys? I have used, and continue to use, a lot of OSes. I started my career with CTOS, and I worked on and with UNIX for more than a decade. I have used various flavors of Linux & BSD since 1995. I have had Microsoft’s OSes and Linux dual booting on my home machines for the last decade. I am really not an OS bigot, as there are things about each that I like. For example, I like Ubuntu and the context cube desktop interface, but I am not sure I want that for my primary operating system. I could buy a basic box and install XP with an older key, but worry I might have trouble finding XP drivers and updates. Being an engineer, I figured I would approach this logically. I sat down and wrote down all the applications, features, and services I use on a weekly basis and mapped out what I needed. Several Linux variants would work, and I could put XP in a virtual partition to catch anything that was not available, but the more I look, the more I like the MacBook. While I have never owned a Mac, I am beginning to think it is time to buy one. And really, the engineer in me got thrown under the bus when I visited the Mac store http://store.apple.com/. %!&$! logic, now I just kind of want one. If I am going through this thought process, I just wonder how many companies are as well. MS has a serious problem. |
| Chinese hacker soap opera [The Dark Visitor] Posted: 05 Jul 2008 10:11 AM CDT On the 21st of June, we told you about SKSgod selling a trojan downloader called “Chinese Hacker Vampire” and the online controversy that ensued when another hacker took credit for it. The end? No, fresh drama has been introduced into this saga. Author of Chinese Hacker Vampire Program JAILED!
On 4 July, News.cn reported that an 18-year-old hacker surnamed Zhou had been arrested in connection with selling the trojan downloader program. Police from Chongqing City launched an investigation into the case after receiving a phone call from an anonymous source who reported that there was a website selling the Chinese Hacker Vampire downloader. According to the report, Zhou’s website even threatened to shutdown the anti-virus software industry.
On July 1st, Chongqing police captured Zhou while still asleep in his apartment and he later made a full confession to the crime. The end? No. Silly police, you can’t arrest a vampire Decided to visit SKSgod’s website and see when he last posted and surprise…it was 5 July. Wait, wasn’t he jailed on July 1st? Nope. SKSgod is just having a real run of bad luck with people stealing his program and identity. On 5 July, he posts an apology to all the people who lost money purchasing the Chinese Vampire downloader and promised to use his energy to create a better program. One person in the comments section suggested that his time and energy could be put to better use. So, that was funny. On 4 July, when the story was breaking about the arrest, he posted three separate articles dealing with the rumor. All three postings had the same theme, complaining about how all this news was hurting his reputation. Is he at all concerned about the poor schmuck shown getting arrested? Nope, this is all about him and his online creds. The end? Who knows. |
| Passport-peeking probably pervasive [Emergent Chaos] Posted: 04 Jul 2008 04:56 PM CDT Back in March, we wrote about unauthorized access to Barack Obama's passport file. At the time, a Washington Post article quoted a State Department spokesman: "The State Department has strict policies and controls on access to passport records by government and contract employees" The idea was that, while snooping might occur, it would be caught by controls put in place specifically to detect accesses to the records of high-profile people. Well, as it turns out the State Department may not be quite as good at detecting such accesses, or at following up (shocking, I know). In a July 4 article, the Los Angeles Times reports: A federal investigation of unauthorized snooping into government passport files has found evidence that such breaches may be far more common than previously disclosed, and the State Department inspector general is calling for an overhaul of the program's management. According to the article, passport files may be viewed by over 20,000 government workers and contractors. In a sample of 150 celebrities chosen for examination by investigators, 85% had been accessed at least once. One was accessed over 100 times (!) in the last six years. Amusingly, at a press conference held on July 4, State said that half of those who had access in March no longer have it. They also were unable to say whether spot-checks on detected accesses were taking place in the past. Put those together and you have a system where at least twice as many people have access as need it, and privileged operations are recorded but the folks in charge do not know if the audit trail is used. The redacted report is available at the C-SPAN web site, but not at the State Department's near as I can tell. Draw your own conclusions. |
| Whathehuhnammm…heh, heh. [The Dark Visitor] Posted: 04 Jul 2008 07:06 AM CDT That was the actual sound that came out of my mouth when I first viewed this picture from Xinhuanet of People’s Armed Police officers demonstrating new Olympic counter-terrorism equipment:
Eastwood, if you can bring me back one of these Segways-of-Death…man, we are buds for life! ![[del.icio.us]](http://images.del.icio.us/static/img/delicious.small.gif){kind=small} |
| Dataloss via Stupidity. [.:Computer Defense:.] Posted: 04 Jul 2008 01:43 AM CDT Sometimes we hear about dataloss via theft or loss of a computer. For the most part (assuming I don't hear about it happening to a company on a weekly basis), I can (eventually) forgive the company (even if my personal data has been lost). After all accidents (losing a computer) and burglaries are a fact of life. Does this excuse the practice of not encrypting data? Nope... but as I said... eventually I forgive the company, after all years ago when these were paper files, they weren't encrypted. At the same time, I do feel that there should be serious government fines handed out to companies that lose sensitive customer data (my forgiveness doesn't exclude the requirement for punishment of some sort). What I can't forgive though is dataloss via stupidity... That is, throwing away sensitive data without making an effort to destroy it. I shred pretty much everything that comes to me in the mail at home... (everything I don't save anyways). I've worked in places where DBAN was utilized religiously before laptops were assigned from one individual to another or old desktops were sold off. I even took a bench grinder to a hard drive one time (although that was more for fun... but it did destroy the data). I just read this blog post (via Consumerist) and it reminded me once again of the stupidity that sometimes happens. I can get replacing old computers... I even get throwing out the computer (although I'd think that there are plenty of places to donate the machine). I can't get leaving your employee and customer databases, along with letters to customers in place (screenshots on the original blog). This really does come down to Dataloss via Stupidity and I think that's how we need to start defining it. Someone needs to go and put a big notice on the door of the offending Curves that mentions how poorly they treat customer data. We should start doing this to all companies that fall victim to Dataloss via Stupidity. This is a prime example of one of those unforgiveable acts. Now I know someone is saying, "But you just said you can forgive accidents... maybe this was an accident." This isn't an accident... Throwing away a letter to a single customer without shredding it that contains personal information... That's an accident. Turning around to grab a drink from the vending machine and having your laptop stolen... That's an accident. Taking a used computer and just tossing it in the trash... that's not an accident... that's stupidity. In Texas they've got a law requiring those that service computers to have a PI license. Perhaps it's time that we start thinking about licensing to use a computer... We could even have stages of licensing:
In reality that's going way overboard (just like the Texas law), but something needs to be done to prevent the stupid from using computers... and something really needs to be done to prevent Dataloss via Stupidity. Perhaps Curves should be slapped with a nice, big fine just to remind people to think first. |
| In Congress Assembled, July 4, 1776 [Emergent Chaos] Posted: 04 Jul 2008 01:18 AM CDT  In CONGRESS, July 4, 1776 The unanimous Declaration of the thirteen united States of America, When in the Course of human events, it becomes necessary for one people to dissolve the political bands which have connected them with another, and to assume among the powers of the earth, the separate and equal station to which the Laws of Nature and of Nature’s God entitle them, a decent respect to the opinions of mankind requires that they should declare the causes which impel them to the separation. We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness. –That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed, –That whenever any Form of Government becomes destructive of these ends, it is the Right of the People to alter or to abolish it, and to institute new Government, laying its foundation on such principles and organizing its powers in such form, as to them shall seem most likely to effect their Safety and Happiness. Prudence, indeed, will dictate that Governments long established should not be changed for light and transient causes; and accordingly all experience hath shewn, that mankind are more disposed to suffer, while evils are sufferable, than to right themselves by abolishing the forms to which they are accustomed. But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security. —Such has been the patient sufferance of these Colonies; and such is now the necessity which constrains them to alter their former Systems of Government. The history of the present King of Great Britain [George III] is a history of repeated injuries and usurpations, all having in direct object the establishment of an absolute Tyranny over these States. To prove this, let Facts be submitted to a candid world. He has refused his Assent to Laws, the most wholesome and necessary for the public good. He has forbidden his Governors to pass Laws of immediate and pressing importance, unless suspended in their operation till his Assent should be obtained; and when so suspended, he has utterly neglected to attend to them. He has refused to pass other Laws for the accommodation of large districts of people, unless those people would relinquish the right of Representation in the Legislature, a right inestimable to them and formidable to tyrants only. He has called together legislative bodies at places unusual, uncomfortable, and distant from the depository of their public Records, for the sole purpose of fatiguing them into compliance with his measures. He has dissolved Representative Houses repeatedly, for opposing with manly firmness his invasions on the rights of the people. He has refused for a long time, after such dissolutions, to cause others to be elected; whereby the Legislative powers, incapable of Annihilation, have returned to the People at large for their exercise; the State remaining in the mean time exposed to all the dangers of invasion from without, and convulsions within. He has endeavoured to prevent the population of these States; for that purpose obstructing the Laws for Naturalization of Foreigners; refusing to pass others to encourage their migrations hither, and raising the conditions of new Appropriations of Lands. He has obstructed the Administration of Justice, by refusing his Assent to Laws for establishing Judiciary powers. He has made Judges dependent on his Will alone, for the tenure of their offices, and the amount and payment of their salaries. He has erected a multitude of New Offices, and sent hither swarms of Officers to harass our people, and eat out their substance. He has kept among us, in times of peace, Standing Armies without the consent of our legislatures. He has affected to render the Military independent of and superior to the Civil power. He has combined with others to subject us to a jurisdiction foreign to our constitution and unacknowledged by our laws; giving his Assent to their Acts of pretended Legislation: For Quartering large bodies of armed troops among us: For protecting them, by a mock Trial, from punishment for any Murders which they should commit on the Inhabitants of these States: For cutting off our Trade with all parts of the world: For imposing Taxes on us without our Consent: For depriving us, in many cases, of the benefits of Trial by Jury: For transporting us beyond Seas to be tried for pretended offences: For abolishing the free System of English Laws in a neighbouring Province, establishing therein an Arbitrary government, and enlarging its Boundaries so as to render it at once an example and fit instrument for introducing the same absolute rule into these Colonies: For taking away our Charters, abolishing our most valuable Laws, and altering fundamentally the Forms of our Governments: For suspending our own Legislatures, and declaring themselves invested with power to legislate for us in all cases whatsoever. He has abdicated Government here, by declaring us out of his Protection and waging War against us. He has plundered our seas, ravaged our Coasts, burnt our towns, and destroyed the lives of our people. He is at this time transporting large Armies of foreign Mercenaries to compleat the works of death, desolation and tyranny, already begun with circumstances of Cruelty and perfidy scarcely paralleled in the most barbarous ages, and totally unworthy the Head of a civilized nation. He has constrained our fellow Citizens taken Captive on the high Seas to bear Arms against their Country, to become the executioners of their friends and Brethren, or to fall themselves by their Hands. He has excited domestic insurrections amongst us, and has endeavoured to bring on the inhabitants of our frontiers, the merciless Indian Savages, whose known rule of warfare, is an undistinguished destruction of all ages, sexes and conditions. In every stage of these Oppressions We have Petitioned for Redress in the most humble terms: Our repeated Petitions have been answered only by repeated injury. A Prince whose character is thus marked by every act which may define a Tyrant, is unfit to be the ruler of a free people. Nor have We been wanting in attentions to our British brethren. We have warned them from time to time of attempts by their legislature to extend an unwarrantable jurisdiction over us. We have reminded them of the circumstances of our emigration and settlement here. We have appealed to their native justice and magnanimity, and we have conjured them by the ties of our common kindred to disavow these usurpations, which, would inevitably interrupt our connections and correspondence. They too have been deaf to the voice of justice and of consanguinity. We must, therefore, acquiesce in the necessity, which denounces our Separation, and hold them, as we hold the rest of mankind, Enemies in War, in Peace Friends. We, therefore, the Representatives of the united States of America, in General Congress, Assembled, appealing to the Supreme Judge of the world for the rectitude of our intentions, do, in the Name, and by the Authority of the good People of these Colonies, solemnly publish and declare, That these United Colonies are, and of Right ought to be Free and Independent States; that they are Absolved from all Allegiance to the British Crown, and that all political connection between them and the State of Great Britain, is and ought to be totally dissolved; and that as Free and Independent States, they have full Power to levy War, conclude Peace, contract Alliances, establish Commerce, and to do all other Acts and Things which Independent States may of right do. And for the support of this Declaration, with a firm reliance on the protection of divine Providence, we mutually pledge to each other our Lives, our Fortunes and our sacred Honor. The signers of the Declaration represented the new states as follows: New Hampshire Josiah Bartlett, William Whipple, Matthew Thornton Massachusetts John Hancock, Samual Adams, John Adams, Robert Treat Paine, Elbridge Gerry Rhode Island Stephen Hopkins, William Ellery Connecticut Roger Sherman, Samuel Huntington, William Williams, Oliver Wolcott New York William Floyd, Philip Livingston, Francis Lewis, Lewis Morris New Jersey Richard Stockton, John Witherspoon, Francis Hopkinson, John Hart, Abraham Clark Pennsylvania Robert Morris, Benjamin Rush, Benjamin Franklin, John Morton, George Clymer, James Smith, George Taylor, James Wilson, George Ross Delaware Caesar Rodney, George Read, Thomas McKean Maryland Samuel Chase, William Paca, Thomas Stone, Charles Carroll of Carrollton Virginia George Wythe, Richard Henry Lee, Thomas Jefferson, Benjamin Harrison, Thomas Nelson, Jr., Francis Lightfoot Lee, Carter Braxton North Carolina William Hooper, Joseph Hewes, John Penn South Carolina Edward Rutledge, Thomas Heyward, Jr., Thomas Lynch, Jr., Arthur Middleton Georgia Button Gwinnett, Lyman Hall, George Walton Image: Washington's copy of the Declaration of Independence, from the Library of Congress. |
| It’s the End of the World as We Know It… [.:Computer Defense:.] Posted: 04 Jul 2008 12:54 AM CDT And I feel fine... By morning most likely everyone will have blogged about the recent court ruling that Google hand over the YouTube logs to Viacom (MTV & Paramount Pictures parent company). Oddly enough I saw a clip on BBC News that was mentioning popular articles on their website. The first thing my wife said was, "Does this mean I should stop going to YouTube?" My immediate response was, "Why?" To which she responded, "If I watch something that's copyrighted, can't I be sued or something?" Now this was the way the short little news clip presented itself, and I'm definitely not a lawyer but my answer was, "No." Now maybe I'm wrong, and I'll probably be the only one to say this, but I don't see how this is a big deal. Viacom wants to compare the viewing habits on their copyrighted material vs non-copyrighted material. I actually think they have a right to do that. It comes down to this... find a way to keep the copyrighted material off the site or give people who's copyrights are violated access to statistics. Based on the article, that's all Viacom wanted... statistics. Well at one point they wanted to YouTube source code but that's a ridiculous request. Google probably should have just granted them access to the statistics right away. I honestly don't care if Viacom figures out who I am and what I've watched on YouTube. I do hope that Google gets the right to anonymize the logs before passing them on, but they should have been doing that all along... there was no real reason to store IP Addresses for any length of time. Anyways... it'll be interesting to see what Viacom gets in the end, and how many people cry that this really is the end of the world. |
| Let Freedom Ring [The Dark Visitor] Posted: 03 Jul 2008 09:36 PM CDT US Declaration of Independence When in the Course of human events, it becomes necessary for one people to dissolve the political bands which have connected them with another, and to assume among the powers of the earth, the separate and equal station to which the Laws of Nature and of Nature’s God entitle them, a decent respect to the opinions of mankind requires that they should declare the causes which impel them to the separation. We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness. –That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed, –That whenever any Form of Government becomes destructive of these ends, it is the Right of the People to alter or to abolish it, and to institute new Government, laying its foundation on such principles and organizing its powers in such form, as to them shall seem most likely to effect their Safety and Happiness. Prudence, indeed, will dictate that Governments long established should not be changed for light and transient causes; and accordingly all experience hath shewn, that mankind are more disposed to suffer, while evils are sufferable, than to right themselves by abolishing the forms to which they are accustomed. But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security. —Such has been the patient sufferance of these Colonies; and such is now the necessity which constrains them to alter their former Systems of Government. The history of the present King of Great Britain [George III] is a history of repeated injuries and usurpations, all having in direct object the establishment of an absolute Tyranny over these States. To prove this, let Facts be submitted to a candid world. He has refused his Assent to Laws, the most wholesome and necessary for the public good. He has forbidden his Governors to pass Laws of immediate and pressing importance, unless suspended in their operation till his Assent should be obtained; and when so suspended, he has utterly neglected to attend to them. He has refused to pass other Laws for the accommodation of large districts of people, unless those people would relinquish the right of Representation in the Legislature, a right inestimable to them and formidable to tyrants only. He has called together legislative bodies at places unusual, uncomfortable, and distant from the depository of their public Records, for the sole purpose of fatiguing them into compliance with his measures. He has dissolved Representative Houses repeatedly, for opposing with manly firmness his invasions on the rights of the people. He has refused for a long time, after such dissolutions, to cause others to be elected; whereby the Legislative powers, incapable of Annihilation, have returned to the People at large for their exercise; the State remaining in the mean time exposed to all the dangers of invasion from without, and convulsions within. He has endeavoured to prevent the population of these States; for that purpose obstructing the Laws for Naturalization of Foreigners; refusing to pass others to encourage their migrations hither, and raising the conditions of new Appropriations of Lands. He has obstructed the Administration of Justice, by refusing his Assent to Laws for establishing Judiciary powers. He has made Judges dependent on his Will alone, for the tenure of their offices, and the amount and payment of their salaries. He has erected a multitude of New Offices, and sent hither swarms of Officers to harass our people, and eat out their substance. He has kept among us, in times of peace, Standing Armies without the consent of our legislatures. He has affected to render the Military independent of and superior to the Civil power. He has combined with others to subject us to a jurisdiction foreign to our constitution and unacknowledged by our laws; giving his Assent to their Acts of pretended Legislation: For Quartering large bodies of armed troops among us: For protecting them, by a mock Trial, from punishment for any Murders which they should commit on the Inhabitants of these States: For cutting off our Trade with all parts of the world: For imposing Taxes on us without our Consent: For depriving us, in many cases, of the benefits of Trial by Jury: For transporting us beyond Seas to be tried for pretended offences: For abolishing the free System of English Laws in a neighbouring Province, establishing therein an Arbitrary government, and enlarging its Boundaries so as to render it at once an example and fit instrument for introducing the same absolute rule into these Colonies: For taking away our Charters, abolishing our most valuable Laws, and altering fundamentally the Forms of our Governments: For suspending our own Legislatures, and declaring themselves invested with power to legislate for us in all cases whatsoever. He has abdicated Government here, by declaring us out of his Protection and waging War against us. He has plundered our seas, ravaged our Coasts, burnt our towns, and destroyed the lives of our people. He is at this time transporting large Armies of foreign Mercenaries to compleat the works of death, desolation and tyranny, already begun with circumstances of Cruelty and perfidy scarcely paralleled in the most barbarous ages, and totally unworthy the Head of a civilized nation. He has constrained our fellow Citizens taken Captive on the high Seas to bear Arms against their Country, to become the executioners of their friends and Brethren, or to fall themselves by their Hands. He has excited domestic insurrections amongst us, and has endeavoured to bring on the inhabitants of our frontiers, the merciless Indian Savages, whose known rule of warfare, is an undistinguished destruction of all ages, sexes and conditions. In every stage of these Oppressions We have Petitioned for Redress in the most humble terms: Our repeated Petitions have been answered only by repeated injury. A Prince whose character is thus marked by every act which may define a Tyrant, is unfit to be the ruler of a free people. Nor have We been wanting in attentions to our British brethren. We have warned them from time to time of attempts by their legislature to extend an unwarrantable jurisdiction over us. We have reminded them of the circumstances of our emigration and settlement here. We have appealed to their native justice and magnanimity, and we have conjured them by the ties of our common kindred to disavow these usurpations, which, would inevitably interrupt our connections and correspondence. They too have been deaf to the voice of justice and of consanguinity. We must, therefore, acquiesce in the necessity, which denounces our Separation, and hold them, as we hold the rest of mankind, Enemies in War, in Peace Friends. We, therefore, the Representatives of the united States of America, in General Congress, Assembled, appealing to the Supreme Judge of the world for the rectitude of our intentions, do, in the Name, and by the Authority of the good People of these Colonies, solemnly publish and declare, That these United Colonies are, and of Right ought to be Free and Independent States; that they are Absolved from all Allegiance to the British Crown, and that all political connection between them and the State of Great Britain, is and ought to be totally dissolved; and that as Free and Independent States, they have full Power to levy War, conclude Peace, contract Alliances, establish Commerce, and to do all other Acts and Things which Independent States may of right do. And for the support of this Declaration, with a firm reliance on the protection of divine Providence, we mutually pledge to each other our Lives, our Fortunes and our sacred Honor. Posted under US attacks…for those men and women who sacrificed so much for our freedom. |
| On Gaming Security [Emergent Chaos] Posted: 03 Jul 2008 05:21 PM CDT Adam comments on Dave Maynor commenting on Blizzard selling authentication tokens. Since I have the ability to comment here, I shall. This isn't the case of a game having better security than most banks (as Maynor says). This is a game company leaping ahead of some banks, because they realize they have bank-like security issues. It's been a year or so since I read on El Reg that on the black market, a credit card number sells for (as I remember) £5, but a WoW account sells for £7. I would look up the exact reference, but I'm not in the mood. Your search skills are likely as good as mine. The exact reasons for this are a bit of a mystery, but there are some non-mysterious ones. There is a black market for WoW gold and (to a lesser extent) artifacts. That black market is shuddering because Blizzard has done a lot to crack down on it. (Blizzard's countermeasures are one main reason that the artifact market is low. Most artifacts become bound to one character when used, and so are not transferrable and so are not salable.) Nonetheless, many WoW players have gold in their pockets that would sell for hundreds to thousands of dollars on this black market. (If you think from this, that WoW can be a profitable hobby, think again. That many players have gold worth some real change says more about the time they have spent playing than anything else. If you live in a first-world country, you can earn far more flipping burgers than playing WoW. It is only if you are in a third-world country that WoW is a reasonable career choice.) This means that by putting a keylogger on someone's system, you can steal a pretty penny from them and sell it on the black market. A not-insignificant number of WoW players have logged into their accounts to find their characters naked and penniless. However, there's an interesting twist on this. Blizzard can and does restore the lost gold and items. Presumably, Blizzard has a transaction log and can rewind it. However, this is work for them and annoyance for the victim. Two-factor authentication will lower Blizzard's costs but fear of robbery is high enough among the players that they're snapping these things up and are willing to pay for them. Bank customers rightly think that increased security is something that the bank should pay for. So in the banking world, the cost-benefit calculation of two-factor authentication is complex. In the gaming world, it's pretty straightforward. Since Blizzard can shift the cost of the device to the customer base, it's easier to justify. |
| netcast for this week: I was the (surprise) guest host on the Netsec Podcast [The Security Catalyst] Posted: 03 Jul 2008 03:02 PM CDT One of the true benefits of sharing thoughts through spoken and written word is the ability to meet quality people. I thrive on conversation - especially discourse that leads to new understanding. I am a firm believer that through purposeful conversation, honest intentions and open minds we can solve a lot of challenges we face. So when Martin McKeay and I were “chatting” online Tuesday night, he popped in with “Hey - no pressure, but do you want to cohost tonight?” It took about a minute to decide. He shared some links to stories to talk about and I took 30 minutes to read them and write down some ideas - and then boom - we recorded. I really enjoyed the conversation and was really amped at the end. It took me a while to get ready for bed - my mind was still engaged. I hope you have a similar experience when listening! Find the show notes here: http://netsecpodcast.com/?p=48 And the direct link to the program here: http://media.libsyn.com/media/mckeay/nsp-070108-ep110.mp3
(PS: I hope you still chose to listen to the programming on The Security Catalyst; however, somewhere in the feedchange, we seem to have confused iTunes. If it doesn’t look like we have new shows - you may want to unsubscribe and resubscribe.) This posting includes an audio/video/photo media file: Download Now |
| The Mozilla Metrics Project [securosis.com] Posted: 03 Jul 2008 12:31 PM CDT Ryan Naraine just posted an article over at ZDNet about a project I’m extremely excited to be involved with. Just before RSA I was invited by Window Snyder over at Mozilla to work with them on a project to take a new look at software security metrics. Window has posted the details of the project over on the Mozilla security blog, and here’s an excerpt:
Although I love my job, it’s not often I get to develop original research like this with an organization like Mozilla. We really think we have the opportunity to contribute to the security and development communities in an impactful way. If you’d like to contribute, please comment over at the Mozilla blog, or email me directly. I’d like to keep the conversation over there, rather than in comments here. This is just the spreadsheet version (and a csv version); the final product will be more of a research note, describing the metrics, process, and so on. I’m totally psyched about this. |
| Want Real Homeland Security? [Emergent Chaos] Posted: 03 Jul 2008 11:32 AM CDT
Given past posts here, regular Emergent Chaos readers will hardly be surprised that I am a supporter of this proposal. While I encourage everyone to read the entire post, it's the closing paragraph that really sums why I think this is so important: Of course, Civil Liberties Advisors may often lose the debate, or even be shunted aside. But sometimes they will win, and sometimes they will raise consciousness and help frame the discussion. Moreover, an administration without such a voice is much more likely to short-change civil liberties than one with such an advocate. The stakes for our nation are simply too high for us to continue to muddle along without someone in this critical position. Indeed, this idea this might well give rise to a whole new meaning to the notion of Homeland Security. And actually if you replace administration with corporation and civil liberties with customer privacy, you pretty much have the argument for why companies need (and have) privacy evangelists.... [Image is 'Real' Homeland Security by richdrogpa.] |
| On Banking Security [Emergent Chaos] Posted: 03 Jul 2008 11:11 AM CDT Dave Maynor comments: Blizzard is going to sell a One Time Password device...Isn't it kind of funny when an online game has better security than most banks?Damnit, Dave, I have nothing to add to that analysis!Blizzard Entertainment, Inc. today introduced an optional extra layer of security for World of Warcraft®, its award-winning massively multiplayer online role-playing game. Designed to attach to a keychain, the lightweight and waterproof Blizzard® Authenticator is an electronic device that generates a six-digit security code at the press of a button. This code is unique, valid only once, and active for a limited time; it must be provided along with the account name and password when signing in to the World of Warcraft account linked to it. |
| YouTube, Viacom, And Why You Should Fear Google More Than The Government [securosis.com] Posted: 03 Jul 2008 10:57 AM CDT Reading Wired this morning (and a bunch of other blogs), I learned that a judge ordered Google/YouTube to turn over ALL records of who watched what on YouTube. To Viacom of all organizations, as part of their lawsuit against Google for hosting copyrighted content. The data transfered over includes IP address and what was watched. Gee, think that might leak at some point? Ever watch YouTube porn from an IP address that can be tied to you? No porn? How about singing cats? Yeah, I thought so you sick bastard. But wait, what are the odds of tracing an IP address back to an individual? Really damn high if you use any other Google service that requires a login, since they basically never delete data. Even old emails can tie you back to an IP, never mind a plethora of other services. Ever comment on a blog? The government has a plethora of mechanisms to track our activity, but even with recent degradations in their limits for online monitoring, we still have a heck of a lot of rights and laws protecting us. Even the recent warrantless wiretapping issue doesn’t let a government agency monitor totally domestic conversations without court approval. But Google? (And other services). There’s no restriction on what they can track (short of reading emails, or listening in on VoIP calls). They keep more damn information on you than the government has the infrastructure to support. Searches, videos you’ve watched, emails, sites you visit, calendar entries, and more. Per their privacy policies some of this is deleted over time, but even if you put in a request to purge your data it doesn’t extend to tape archives. It’s all there, waiting to be mined. Feedburner, Google Analytics. You name it. Essentially none of this information is protected by law. Google can change their privacy policies at any time, or sell the content to anyone else. Think it’s secure? Not really- I heard of multiple XSS 0days on Google services this week. I’ve seen some of their email responses to security researchers; needless to say, they really need a CSO. I’m picking on Google here, but most online services collect all sorts of information, including Securosis. In some cases, it’s hard not to collect it. For example, all comments on this blog come with an IP address. The problem isn’t just that we collect all sorts of information, but that we have a capacity to correlate it that’s never been seen before. Our laws aren’t even close to addressing these privacy issues. On that note, I’m disabling Google Analytics for the site (I still have server logs, but at least I have more control over those). I’d drop Feedburner, but that’s a much more invasive process right now that would screw up the site badly. Glad I have fairly tame online habits, although I highly suspect my niece has watched more than a few singing cat videos on my laptop. It was her, I swear! |
| IT and Infosec Insourcing: Could You Do It If You Wanted To? [BlogInfoSec.com] Posted: 03 Jul 2008 06:00 AM CDT There was an article by Timothy Aeppel on the front page of the June 13, 2008 issue of The Wall Street Journal with the title “Stung by Soaring Transport Cost, Factories Bring Jobs Home Again” (subscription required). The article is about manufacturers bringing back some of their production from China to domestic plants because the rapidly increasing costs of shipping, labor and raw materials exceeded cost savings. A company president related that his company was fortunate to have held on to its manufacturing machinery, saying: “What looked like an albatross a year and a half ago … today looks like a pretty good asset.” There is an analogy with IT and information security outsourcing. The rationale is not based upon transportation - indeed the cost of electronic message transmissions is going down, not up. No, it is the high inflation, particularly in the compensation of technical and operational staff in countries such as India, which is beginning to shift the balance. But if the economics tips in favor of bringing back IT and business processes and their commensurate security onshore, would we be as fortunate as the manufacturer in still having individuals with the requisite skills and experience to do the task? Or have we already rid ourselves of these former albatrosses. There are several issues in this regard, many of which I address in my book Outsourcing Information Security. Let me repeat some of them here. They are:
I also discuss risks related to planned changes, which include outsourcing and insourcing, in an earlier column, Security and Change (pt. 3) - White Knights. You can overcome aspects of the above areas after the fact, but it can be considerably less expensive if you anticipate the ending of relationships and potential insourcing when you are negotiating the service agreement. Let’s look at each of these factors in more detail. (...) © C. Warren Axelrod for BlogInfoSec.com, 2008. | Permalink | No comment This feed is copyrighted by bloginfosec.com. The feed may be syndicated only with our permission. If you feel that this feed is being syndicated by a website other than through us or one of our partners, please contact bloginfosec.com immediately at copyright_at_bloginfosec.com. Thank you! |
| Is There a Good 0day? [ImperViews] Posted: 03 Jul 2008 03:44 AM CDT There's an unusual story in the July issue of FastCompany.com that lets us peek into the world and life of a zero-day trader, which, is actually a security researcher that develops 0days in his free time to found a new The "concept" of selling zero-days is not new. Some might argue that there's a lot of benefit. Others will claim that it only plays to the hands of the bad guys, legitimizing some of their actions. At any rate, I believe that there is a consensus (IMO :-) within the community that the bad guys have changed their business model. It's not about the fun, fame or glory. They are after corporate assets, live credit card numbers and soon-to-be-victims' identities, not to mention the role of foreign governments and agencies. The article describes several zero-day exploits in database systems and ERP applications. Scary. Along the years, Imperva's Application Defense Center (the ADC) discovered many vulnerabilities in various systems. Some were very critical and yet we are waiting for the vendors to patch all the vulnerabilities (as listed on our ADC's page, there are several more vulnerabilities that are waiting for the vendor's patches to be released). So is there a good 0day? I like to say that "there is always one more bug" and as long as code exists, someone will find a way to break it. Nothing should be considered immune and zero-days (without notifying the vendors that issue the remedy) in general should be considered bad as they expose a weakness without providing a protection.  Click on the picture to see the good and bad O'Day. From left to right: Aubrey O'Day, Hank O'Day, Tom O'Day |
| The *aaS Alphabet Soup [ImperViews] Posted: 03 Jul 2008 01:52 AM CDT One of the merits of living in the Silicon Valley is being able to exchange ideas, meet the guys that make it happen and live the buzz (or buzz life). In the past year or so, the frequency of the small talks we have around services in the cloud has increased significantly. Take a look at TechCrunchIT and all you see is picture of clouds. Looking back a few years, I was part of a failed attempt to build Exchange as a service and backup as a service in 1998 (Publicom alumni, step up:-) so it was fun to read Rich Tehrani's article yesterday, about the hosted application market, pointing more to the database as a service or platform as a service or application as a service (PaaS, DaaS, AaaS or, in short *aaS) but unfortunately he wrote only few words regarding security. As enterprises try to reduce their cost and align computing requirements with actual use and the need to cost-effectively provision database infrastructure to support real time usage, the new *aaS technology and market emerges. Googling for "database as a service" or "platform as a service" will bring many results. Some of the behemoths (Google, Amazon) as well as less established companies such as LongJump offer services that will allow you to leverage the benefits of database in the cloud. Most offerings lack the same maturity level of security and activity monitoring that in house database deployment offers. The growing adoption of *aaS platforms still does not include many applications that store private data or sensitive information in the cloud. As the demand grows, organizations should pay attention to the level of security and auditing capabilities that they have from the "cloud." |
All around cool guy, and former provost of the University of Chicago, Geoffrey Stone (the Edward H. Levi Distinguished Service Professor at the University of Chicago Law School), posted earlier this week proposed that "The next president should create a brand new position, which should become a permanent part of the Executive Branch in the future: | You are subscribed to email updates from Black Hat Security Bloggers Network To stop receiving these emails, you may unsubscribe now. | Email Delivery powered by FeedBurner |
Inbox too full?  Subscribe to the feed version of Black Hat Security Bloggers Network in a feed reader. | |
| If you prefer to unsubscribe via postal mail, write to: Black Hat Security Bloggers Network, c/o FeedBurner, 20 W Kinzie, 9th Floor, Chicago IL USA 60610 | |
No comments:
Post a Comment