Network Security Blog

Well, we’d hoped to avoid the “sleep deprivation” part, but it doesn’t look like that’s going away any time soon. Regardless, we scrounged together a show this week, discussing “hacking”, “anti hacking” (law), and the perils of social networking.

Network Security Podcast, Episode 307, March 26, 2013

Time: 39:40

Show notes:

• Miami’s Voter Fraud Is Only the Beginning of Election Hacking
• Draft House Judiciary cybersecurity bill would stiffen anti-hacking law
• South Korea data-wipe malware spread by patching system
• Weak keys in NetBSD
• mongodb – SSJI to RCE
• FireMe!: A Running List of People Tweeting How Much They Hate Their Jobs
• Tonight’s Music: Open Our Eyes by amplifico

If you haven’t already read it, your homework for this week is the Mandiant APT1 Report.  Don’t read someone else’s interpretation until you’ve read the report yourself.  Don’t read the analysis of reporters and consider it good.  Read the entire report yourself and draw your own conclusions, then read what other people have to say.  But in any case, read it.

If there were an “Offensive Security for Dummies” book, it’d be very short.  Chapter 1 would simply be the word “Don’t“.  Chapter 2 would be slightly more expansive and would say “No, really, we mean it: don’t practice offensive security.  You’re not worthy”.  Then it would go on to enumerate ways to incorporate offensive security measures into the enterprise, because IT and Security people are well known for skipping the first few chapters of any book and going straight for the meat of the matter.  And then ignoring a lot of that as well.

Seriously though, every couple of years the idea of ‘attack back’ technologies or retaliatory techniques comes up in the security sphere.  The basic thought pattern goes somewhere along the lines of “I’m getting attacked, I can’t do anything about it other than take the beating, the government isn’t doing anything and I’m tired of feeling like a punching bag.  Since the authorities can’t do anything, maybe I should take matters into my own hands.”  The idea of vigilante justice, even in the digital sphere, is appealing.  The visceral thrill of getting a little justice of your own is understandable, and even a little desirable in the person protecting your network.  But it’s morally and legally indefensible.

The biggest problem with retaliation is attribution in my mind; even with some of the best minds in the business working on the problem it’s impossible to really say who’s behind many of the attacks presently.  Sure, we can say ‘this is the origin IP of the attack’ and follow the command and control structure up a level or two, but it’s nearly impossible to tell which of those systems is owned and operated by the attacker and which are compromised systems used as throw away stepping stones.  Given the amount of time it takes to get even that level of information, I can’t see most administrators taking the time to really find the source of the attack.  I can see them simply attacking the end node of the attack and crowing when they bring down Grandma’s Win98 machine in Wisconsin though.

And to me, one of the biggest problems with retaliation is time and resources.  Seriously, how many security professionals do you know that have the time to properly secure their own enterprises properly?  If you don’t have time to review firewall configurations, get developers to stop including SQLi vulnerabilities in the web site and generally being a pain in the ass about corporate policies, what makes you think you have the time to do proper attribution before you attack?  Quite frankly, after having been a QSA for four years and reviewing a couple of hundred firewall configurations, I don’t trust 75% of companies to properly lock down their own networks, let alone start targeting other people’s networks with retribution tools.  Would you trust your own senior security architect to run invasive scans against your own site, let alone someone elses? 

I’m betting this whole conversation will reach a peak somewhere in March of 2013, then go back in it’s cave to hibernate for another couple of years.  It’s a bad idea that sounds good until it’s put in practice.  There might be 1% (probably less) of organizations that have the technical skills and understanding to make retaliation feasible and effective.  But feasible doesn’t mean right, either in the eyes of the law or morally.  If you’re seriously considering retaliatory security, do us all a favor and go review your firewall configuration and logs instead.  I can guarantee you’ll find flaws in the configuration your time would be better spent fixing.

It’s Rich that’s out this holiday week, so Martin and Zach talk turkey (no pun intended) about Skype SNAFUs, LTE going all a-splode-y, and a Linux rootkit that will make you go “That’s…neat…?”

Happy Thanksgiving!

Network Security Podcast, Episode 297, November 20, 2012

Time:  31:00

Show notes:

• Skype password flaw made stealing accounts easy
• Obama signs secret directive to help thwart cyberattacks
• One Simple Trick Could Disable a City’s 4G Phone Network
• FreeBSD.org intrusion announced November 17th 2012
• HTTP iframe Injecting Linux Rootkit
• Tonight’s Music:  Nalts with Ax Chase Turkey

This week we start by discussing Martin’s ear wax and Rich’s cough, and it’s all downhill from there. Zach is out this week, but Rich and Martin open with a discussion of the Cloud Security Alliance conference and some things we both learned between there and the events Martin has been at. Then we delve into the week’s news.

Network Security Podcast, Episode 296, November 13, 2012

Time:  37:17

Show notes:

• Many large companies sued for using (a version of) SSL/TLS by a patent troll. This is an important story you really need to keep an eye on.
• Petraeus outed by Gmail. Email location data was used to identify the people behind the accounts.
• DDoS marketing stunt goes bad.
• Google implements Do Not Track in Chrome.
• MasterCard rolls out credit card with built in PIN pad and display.
• Tonight’s Music:  Edie Carey with Under a Sky

Rich is M.I.A. again, and we’re left do discuss Russia, “the biggest problem in computer security”, and the perpetual badness of industrial control systems.  And hopefully by the time you read this, all of the Presidential excitement will be over, or you’ll have a drink in hand and won’t care any more.

Network Security Podcast, Episode 295, November 6, 2012

Time:  35:06

Show notes:

• The Biggest Problem in Computer Security
• Proactive defense prudent alternative to cyberwarfare
• How Georgia doxed a Russian hacker (and why it matters)
• Russia deploys a massive surveillance network system
• Unprotected backdoor into industrial control systems
• Digital Bond – 3S CoDeSys
• PayPal, Symantec hacked as Anonymous begins November 5 hacking spree
• B-Sides PDX
• Tonight’s Music: Proof I Exist with Ghost Rider

“The Internet will never again be as free as it is this morning” – Dan Geer at SOURCE Boston

Think on that for a while.  If it doesn’t scare you, it should.

Update:  Here’s the full text of Dan Geer’s talk at SOURCE Boston

Unlike it’s brethren, SOPA and PIPA, CISPA doesn’t scare me because it’s aimed at shutting down piracy and giving the media companies unheard of powers. CISPA scares me because it is aimed at letting companies share information between each other and with the government in order to stop bad guys, which is a noble cause. Unluckily, CISPA is written in such a way that 1) it tramples on the very basic rights of due process and privacy to combat these threats and b) it includes clauses that name intellectual property and private information as reasons for this sharing. Which places us right back in SOPA/PIPA land, because it now the media companies are back in the thick of things.

Let’s have some laws to promote information sharing. But let’s not give up our civil liberties and make our government into more of a surveillance state than it already is.

Update:  At the suggestion of a co-worker, I sat down and read the entirety of the CISPA bill, only to find it had changed significantly from when I’d first skimmed over it.  Several of the clauses that would have allowed the media companies to share information freely if they suspect piracy have been changed to clarify that it’s only if there is an attempt at network compromise that the CISPA sharing would be invoked.  Of course, that might not stop businesses from claiming they’re justified in sharing, which is a fairly likely event given previous experience with many media companies.  It also got a little worse in some ways, including the power infrastructure companies and limiting the liability of companies even more and making it nearly impossible to claim a violation, provided you can even find out there was one in the first place.  Techdirt has a good explanation of some of the changes.  There’s improvement, but not enough that we shouldn’t do everything we can to stop this law in it’s current form. 

Infographic designed by Lumin Consulting

If you don’t know who Bruce Schneier is, I hope you’re coming to my site because I wrote about the TSA, not because your a security professional.  He wrote several books that are staples on almost every security professionals’ shelves.  You could literally say he wrote the book on applied cryptography, since that’s the title of one his book.  He’s been in the security community for a long time, he’s contributed a lot over the years.  And he’s one of the TSA’s biggest critics in the security field.

Last Friday, Bruce had been invited to a House Committee on Oversight and Government Reform to talk about the effectiveness of TSA security measures.  Perhaps unsurprisingly, someone at the TSA caught wind of the fact that he was supposed to be there in person, challenging TSA assertions and had his inclusion in the proceedings blocked.  For some odd reason, the TSA is leery of having someone on the panel who not only understands most of the visible security measures we experience at airports, but can also articulate that in a manner the public can understand.  Of course, the reason the TSA claims they had him blocked is because of a lawsuit he currently has going on against them.

The TSA (and the DHS) is well aware of their detractors and takes great pains to avoid directly confronting any of them or giving critics a chance to get real answers to charges of ineffectiveness.  And Bruce Schneier has been one of the voices that’s taken them to task many times, coining the term ‘security theater’ to describe security that looks like it’s making us more secure while really providing little or no actual protection.  In fact, security theater is often harmful, since it makes us think we’re safer than we really are. 

One thing people tend to forget is that the TSA is a political organization first and foremost.  The people who run the DHS, currently Janet Napolitano, are appointed politicians who’s primary goal is not security, is not safety, but is instead simply keeping their jobs and doing whatever it takes to appear effective.  I know it’s cynical, but politics have always been about appearances rather than the actual utility of the actions politicians take.  And since the TSA’s role is so well defined, it’s easier to measure that effectiveness, or lack there of, than it is with many governmental agencies.  Which is why in most airports, no one is keeping count of the number of people who opt out of backscatter x-rays; if we counted, there would be metrics that could be used as a yardstick.  But of course, we wouldn’t want to know how good or bad our security measures are, since that means we’d expect changes to be made to make them more effective.

I had the dangers of mixing politics and security at the TSA made painfully clear to me several years ago when I had a chance to interview Michael Chertoff, who was then the outgoing head of the DHS.  At one point I asked Mr. Chertoff if there was ever going to be a time when we don’t have to take off our shoes when going through a security checkpoint.  His basic answer was, “I’m a politician.  The shoe bomber happened and if I don’t make sure it never happens again it’s the end of my career, so you’ll have to keep taking your shoes off for the foreseeable future.”  Which told me that for a career politician, protecting his career is much more important than protecting the folks who are traveling through the airport.  And by the by, Mr. Chertoff went to work for one of the companies who build and sell backscatter x-rays to the TSA when he left office.  Let that one sink in for a while. 

All in all, this is just one more data point in the argument that the DHS and TSA are less about actually protecting the public than they are about perpetuating a political power base built on fear of a once in a lifetime event.  The TSA has created a situation where people have given up a number of personal freedoms for the very thin illusion that they may be safer while flying.  But the sheer amount of inconvenience and humiliation that the TSA has heaped upon travelers is gathering more and more momentum for change as the public gets tired of it.  Which tells me that we might see some sort of incident or another in the near future that will re-instill fear of terrorists in the public.  Or is that too much cynicism and paranoia?  It is security theater after all.

Unless you were hiding under a rock the last few weeks you’ve probably heard about the Stop Online Piracy Act (SOPA), Protect IP Act (PIPA) and their even more evil brother Anti-counterfiting Trade Agreement (ACTA).  Many sites went dark last week, including Securosis, in protest and SOPA/PIPA were at least stalemated for the moment, if not entirely defeated.  And since it’s a big story, we decided to discuss it at great length, probably saying many things that have been said by much smarter people than us.  At least we hope it’s the smart people we’re agreeing with.

Zach was unavailable tonight, so we had to pull in two special guests in order to replace him.  First off, Rich’s partner in crime at Securosis, Adrian Lane, joins us.  Second, we’re joined by Liquid Matrix author and friend of the show, Jamie Arlen, aka @myrcurial.  Jamie brings a little bit of an outsider’s viewpoint to the conversation as he’s not native to the Phoenix area and comes to us from north of the border.

No real show notes tonight, if you’re intersted in learning more about SOPA/PIPA/ACTA, do a little Googling.  Or just go to the Electronic Frontier Foundations web site.

Network Security Podcast, Episode 265, January 24, 2012

Time:  55:00

Tonight’s music:  Signs are Signs by The Midnight Hour