A nice story reported by ISC today! A Linux kernel vulnerability has been discovered in the Linux kernel (and was present for a while IMHO!)

The vulnerability origin was not the “human being the keyboard” but the compiler! GCC, the GNU C compiler has lot of optimization features (If you are interested, have a look at this article from the LinuxJournal.com about GCC optimizations).

As explained on the ISC diary page, the vulnerability was very difficult to detect while reading the source code. It’s due to an optimization by the compiler: GCC decided to skip a condition block, enabling a security breach in the code.

A new vulnerability is never good but what else can we “learn” from this story? The Linux code is constantly reviewed by hundreds of developers and the problem described here was very difficult to detect. That’s why you need multiple lines of defenses: You cannot rely only on a strong source code audit, you have to take other countermeasures. Also, can you trust the tools you use on a daily purpose? Who knows exactly what kind of optimizations are performed by the GCC compile when optimization is enabled? GCC is used by thousands of developers every day and, for sure, the same kind of vulnerability exists in other applications. Keep this in mind!

Source: http://isc.sans.org/diary.html?storyid=6820

The financial group ING announced a partnership with NetLog, the Belgian social network website.

On a marketing point of view, this is a good action to attract young potential customers. ING (one of the top-3 bank in Belgium) will catch them on Netlog hoping that, later, they will switch to the real world by using real banking services with ING.

ING will provide virtual money (called “credits”) to all NetLog users. Classic operations will be available: receiving credits when performing special actions (like using a credit card, by SMS, etc) and buying online services with them. Of course, ING will have a virtual office on NetLog where financial operations will be performed.

But… What about the security? Big communities like NetLog (500K Belgian users according to the website) are potential targets for phishing attacks. The NetLog users database could also become a target. Fortunately, it seems that it won’t be possible to sell “credits” to receive money. But anyway, message to the future ING virtual money users: Take care!

Check out the official page in French or Dutch.

Click to enlarge

Regular expression (or regex) [Wikipedia] are a very powerful method to parse data and extract the information you need. But a regular expression can quickly turn into a nightmare due to its complexity. I often use a memo but testing the regexp live is the quickest way to debug them.

Edmund Weitz wrote a nice tool called “Regex Coach” which does exactly I wanted. The last version of his tool runs only on Windows operating systems. According to the author, the Linux version had less success and took time to be maintained. Sad!

Check http://weitz.de/regex-coach/ for details and installation instructions. A great tool!

Click to enlarge

This afternoon I was looking for a Wi-Fi hotspot!

Ready for some Security Through Obscurity fun?
I’ve been playing with TrueCrypt’s Boot Loader Screen Options to display a custom message when I boot my laptop with full disk encryption.

It’s probably enough to be misleading during a casual inspection of your laptop:

The screen doesn’t even display asterisks when you type your TrueCrypt password.
It’s just as unresponsive as the original “NTLDR is missing” screen.
The only difference with the Windows XP NT Loader missing message, is that the original is just a bit longer:

Or you can just let it display gibberish, like this:

And if challenged, say your laptop was infected with a virus from that damned hotel’s WiFi network.

Today, I’m showing you how you can patch your PDF reader (Foxit or Adobe) to handle PDF documents with hidden embedded files. And for Foxit, there’s a bonus: Foxit Reader can also embed files into existing PDF documents.

In my stego PDF trick, I just replace the name /EmbeddedFiles with /Embeddedfiles in the PDF document. As the PDF language is case-sensitive, your PDF reader doesn’t recognize /Embeddedfiles, and hence doesn’t handle the embedded file. PDF readers are designed to skip features of the PDF language they don’t understand (i.e. new features of the PDF language), so that’s why you don’t get an error message from your PDF reader for /Embeddedfiles.

If you search for the string EmbeddedFiles in the binaries of your PDF reader and replace it with Embeddedfiles, it will handle PDF documents with hidden embedded files (but it will stop supporting PDF documents with visible embedded files).

Doing this for Foxit is easy, as there’s only one binary, Foxit Reader.exe. Open it with a hex editor and search for EmbeddedFiles:

Replace it with Embeddedfiles and save it:

That’s it, now you use your patched Foxit Reader to reveal hidden embedded files:

And have you noticed the Add button? Foxit Reader also provides support to add embedded files to existing PDF documents! So you’re not limited to using my Python program to create your own PDF documents.

For Adobe Reader, the trick is the same. Open AcroRd32.dll in a hex editor and do a search and replace (I had to patch 2 instances of of EmbeddedFiles).

My corrupted PDF quip inspired me to program another steganography trick: embed a file in a PDF document and corrupt the reference, thereby effectively making the embedded file invisible to the PDF reader.

The PDF specification provides ways to embed files in PDF documents. I’m releasing my Python program to create a PDF file with embedded file (I used make-pdf-embedded.py to create my EICAR.pdf).

Here’s how a PDF document with an embedded file looks like:

/EmbeddedFiles points to the dictionary with the embedded files:

As names defined in the PDF specification are case sensitive, changing the case changes the semantics: /Embeddedfiles has no meaning, and thus the PDF reader ignores it and doesn’t find the embedded file.

Actually, I used this trick in my Brucon puzzle. I used the –stego option of make-pdf-embedded.py:

Of course, once you know the stego trick, it’s easy to recover the embedded file: edit the PDF document with an hex editor and change the case back to /EmbeddedFiles.

But if you want to make it harder to detect, use PDF obfuscation techniques. Or embed the file twice with incremental updates. First version is the file you want to hide, second version is a decoy…

The PDF language offers so many features to hide and obfuscate data!

Download:

make-pdf_V0_1_2.zip (https)

MD5: 305D57692C27DD3CD91D8C85A3932948

SHA256: A030BBCB8B54137D8047A4CB5C350725599383A4B113CABBA8871AC221378C5B

Per request, I release my assembly code I’ve used in my previous blogposts to display a message box when the injected shellcode gets executed. It’s nothing special, but it will save you some time when you need a similar program.

Assemble the code with nasm like this:

nasm -o sc-mba-hello.bin sc-mba-hello.asm

I use the DLL locating code published in The Shellcoder’s Handbook, you can find it in the include file sc-api-functions.asm. MessageBoxA is located in user32.dll, this dll has to be loaded in the process you’re injecting with sc-mba-hello.

sc-ods.asm is a similar program, calling OutputDebugStringA in stead of MessageBoxA.

Download:

my-shellcode_v0_0_1.zip (https)

MD5: F215B29BA3C8F24CFBA5C24BED65B68A

SHA256: EA1DB8028954CEB18B8AD2EB37CA6BA0CD7CDC6B9A64F10561382152701C013F

The shellcode:

Did you know Nokia mobile phones with the S60 platform can be programmed in Python? During my last holiday, I wrote a small program for time lapse photography with my mobile. Here is the result, showing tidal ebbs and flows in Saint-Vaast-la-Hogue and Cancale:

This is the Python program I wrote to take a picture every minute:

#!/usr/bin/python __description__ = 'Tool to take pictures with a Nokia phone at regular intervals'
__author__ = 'Didier Stevens'
__version__ = '0.1.1'
__date__ = '2009/06/22' """ Source code put in public domain by Didier Stevens, no Copyright
https://DidierStevens.com
Use at your own risk History: 2009/06/17: start 2009/06/22: refactoring Todo: Get Threading to work
""" import camera
import time
import os timelapseFolder = 'e:\\timelapse\\'
sleepTime = 57 def TakeAndSavePicture(): global timelapseFolder now = '%04d%02d%02d-%02d%02d%02d' % time.localtime()[0:6] pic = camera.take_photo() pic.save(os.path.join(timelapseFolder, now, '.jpeg')) print 'Picture taken: %s' % now def Main(): global timelapseFolder global sleepTime print 'Timelapse photography started' if not os.path.isdir(timelapseFolder): os.mkdir(timelapseFolder) print 'Timelapse folder created: %s' % timelapseFolder print 'Wait between pictures %d' % sleepTime while True: TakeAndSavePicture() time.sleep(sleepTime) if __name__ == '__main__': Main()

And then I use Avisynth to combine the jpeg pictures in a movie like this (I join pictures 00001.jpg through 00197.jpeg, 5 per second and produce a 25 fps movie):

ImageSource("%05d.jpeg", 1, 197, 5).ChangeFPS(25)

As you are all aware, the WHO has recently raised the pandemic alert for the Influenza A H1N1 strain to level six .

A Pandemic can have effect on your business and it is worth looking out for what you can do to mitigate that impact but imho, there’s some caveats too.

While pandemic influenza is hot news, it still is an event that happens about every 50 years. Let’s do some math, starting from the known pandemic casualty numbers. The Spanish flu in 1918/19) killed 50 million people worldwide. there were 1,6 billion people alive at that time. That’s about a 3% mortality rate. 500.000.000 were actually infected, meaning 30%. In our current day and time, about 2 billion people would be infected and an estimated 6.000.000 people would actually die from the disease.

Let’s see what impact this may have on our company … of 2000 employees. 600 may become ill, over a period of 2 years. Not everybody will get ill at the same day, Not everybody will be absent for the same amount of time, but about 60 employees will not return to their desk after they became sick. 600 absentees for an average period of 2 weeks, that’s 6000 mandays lost. at $30 an hour, this results in $1,4 mio lost, gone, down the drain. Additional losses can occur, business will slow down eventually so let’s double that number : $2,8k lost, gone, down the drain. But wait … the chance that it happens … was once every 50 years !! That would actually mean that you can spend about $56k/year on pandemic planning …

That’s NOT A LOT FOLKS !! ok, it’s a basic calculation … but still : What the FUD ? There is not a lot of working groups you can fund with that over a prolonged period of time and it sure doesn’t buy a lot of Tamiflu doses, operational masks, gloves, soap, …

IMHO, if you have to start planning for a Pandemic now, you’re too late. 70 to 80% of what you can do in case of a pandemic should already be in your BCP Strategy. That is, if you have one

BTW, Brian Honan of BHConsulting.ie has written a blogpost on what you can actually try to do during pandemic situations : http://bhconsulting.ie/securitywatch/?p=664

In today’s IT environment, there’s an overwhelming load of challenges coming at you like an avalanche every single day.
Moreover, the challenges come from every possible direction you can look in. Windows, Linux, Unix in your LAN, WAN, DMZ interconnected by highly available converged networks transporting data, voice and video which is generated and consumed by on-premise or hosted applications (say CLOUD !). It’s a tough job but someone’s got to do it. Right ?

As HR tried to put everyone into little boxes based on skill assessments, we grew apart. We built high, enforced walls around our cubicles. The *nix guys laugh at the Windows guys when there’s another virus outbreak. They join forces when it’s time to curse at the network guys as the 24/7 network turns out to be, well, not so 24/7 anymore :-s The network guys (and girls…) pick up their voodoo dolls when the application people demands a ginormous amount of bandwidth or some unreasonable number of ports to open on the perimeter. Everybody rolls their eyes when HR decides to use some new fancy app, cloudified of course, to try and manage their skills and at the same time make those little boxes even smaller. The circle is oval.

Because we have compartimentalized our infrastructure management to a very high degree, securing it becomes mighty difficult. There is no Windows person who will accept authority from a Unix person, and vice versa. This is bad people. It’s time for change !!!

If you are responsible for Information Security, you have to be platform agnostic. Incident handling is not depending on the platform it is executed against. Sure, somebody is gonna be responsible for realizing the vision you have defined, but in the end, they are all part of a big team. It’s better to start out with a fight, settle it once and for all, and move on together. Appointing someone responsible for [platform of choice] security and letting them do their thang doesn’t cut it anymore.

Bring all those great minds together, make them realize that they are not alone and put your joint energy in fighting this (unfair) fight together instead of against eachother.

Now y’all go hug eachother and have a mighty fine weekend !

OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

It runs on

• Linux
• MS Windows
• AIX
• Solaris
• …

OSSEC installs stand-alone on a single system, in server mode or in agent mode. For the sake of this blogpost, I will assume that at least one server is used. I will also not touch on the Windows installation.

Log Analysis

On a agent system, in ossec.conf, you define which log files will be monitored. Any new events in this logfile will be transferred to the OSSEC server using a secured connection. Note that there is no analysis of an event on the agent.

A server ‘decodes’ the event, pulling out critical information, this information is compared to rules. rules are extremely powerful in OSSEC. You can define single rules, but you can also define rule trees. I will dedicate a seperate blogpost to rule trees, imho this is where the power of OSSEC is. Alerts are triggered on a level between 0 (ignored) and 16 (attack occured). Alerts can be logged and sent out in e-mail (or even SMS) to your incident handlers.

Ow, wait. Your OSSEC server can be configured to be a syslog server too … and you can have all your appliances (firewall, switch, proxies, routers, mail security thingies, … forward logging to there. Now you can correlate end-to-end logging, FOR FREE !!

OSSEC, in it’s turn, can provide it’s syslog output into another SIEM if need be. It’s open,remember ? Open works both ways for OSSEC

System Integrity Checking

On the OSSEC client you define which directories need to be checked for file integrity. OSSEC will perform a scheduled analysis of the files in these directories and alert you when changes have been detected. You have full granular control over the analysis schedule, low-risk directories can be checked on a daily basis, while high-risk directories can be checked every 20 minutes. You can even exclude certain subdirectories (maybe because they contain files that change regularly and you’re ok with that …). I told you, OSSEC rocks !

Active Response

And it gets better !! You can trigger scripts based on the alerts OSSEC throws. Now you can block access from a bad host entirely, remove execute permissions frm a file that was changed, stop a service …

OSSEC just turned in an HIPS, and it is still free …

Unfortunately, a lot of business are still wary of introducing Open Source solutions in their infrastructure. After all, who’s gonna support them? Third Brigade, the owners of OSSEC, has recently been acquired by TrendMicro, who has vouched that OSSEC will remain Open Source and Third Brigade will continue to support the software.

If you are looking into HIDS/HIPS solutions, don’t forget to consider OSSEC. It’s a beautiful solution, and cross-platform to boot. Don’t hesitate to ask questions if you get stuck !!

You can find more info about OSSEC here : http://www.ossec.net

If you are gonna try and learn OSSEC to the bone, consider buying this book.

Oh yeah, an OSSEC plugin was developed for Splunk too !!! read more here

I, for one, am an OSSEC aficionado. Now you go download it … and tell me what you think.

Table of contents:

* Malicious PDF: Get owned without opening
* Review: IronKey Personal
* Windows 7 security features: Building on Vista
* Using Wireshark to capture and analyze wireless traffic
* “Unclonable” RFID - a technical overview
* Secure development principles
* Q&A: Ron Gula on Nessus and Tenable Network Security
* Establish your social media presence with security in mind
* A historical perspective on the cybersecurity dilemma
* A risk-based, cost effective approach to holistic security
* AND MORE!

You’ve been relying on that IPSec or L2TP VPN solution for a few years now. You’re either using a dedicated VPN solution (genre Cisco VPN Concentrator) or terminating VPN somewhere on your perimeter or in a DMZ (good thinking !!) and (hopefully) you got a set of policies and access control strategies to secure it even further.

You’re happy. Your users are happy. Why change ? Either you need to change to support the business needs or you have to change because the product you are using has been declared end of life. If the former is the case, you’re in a better position to evaluate because you (or your company) realized that the current setup just doesn’t cut it anymore. If the latter is the case, you might be reluctant to investigate your options. Your plate is already overfull and this is just another project that needed to be finished yesterday.

Wait … checking out all your options is worth it. And there aren’t that many … You can either remain with IPSec/L2TP or you can choose a SSL/TLS VPN Solution. Both have pro’s and con’s though.

An IPSec solution needs a client installed on the workstation making the connection. That’s good because then you know only the people with the client (and the correct configuration) can connect. However, if you have external parties connecting (say service providers, consultants, …) how sure can you be that the client, the configuration and even the user certificate is not shared among multiple users ?

Most SSL/TLS VPN solutions do not require a client for limited functionality like web access to an internal website. Other functionality, like a VPN tunnel or RDP/Citrix access to a server, will require an ActiveX or Java control/applet to be installed on the endpoint. It isn’t clientless but the big advantage is that the user pulls the configuration and software from the box, you don’t need to distribute software and configurations.

Moving from one IPSec solution to the other requires thorough planning. If you change vendors, keep in mind that VPN client applications don’t tend to like eachother. Most of the time you can not run 2 VPN Clients on the same box. This might have major implications on your road warriors who will come into the office only sporadically. If something goes wrong, they lost their lifeline …. NOT GOOD.

Moving from IPSec to SSL/TLS however … while planning is still needed, it’s less of an headache because you only need to provide the new procedure to the end users. But the technology change might force you to rethink your architecture.

Some pointers :

- 2-Factor authentication : the main SSL/TLS VPN solutions support easy integration with 2-Factor authentication solutions. While it’ll cost you extra, I wouldn’t suggest SSL/TLS without it. The least you wanna know is that the user connection to your network is who she says she is.

- Client verification : Since you are no longer in control of which endpoints your users use to connect to your network, you have to make sure that the endpoints meet a certain security standard. To the very least, the solution should support OS detection, AV/AS detection. Most of the solutions go further and allow you to build granular policies to allow access to resources based on which endpoint connects. John D connecting from a internet kiosk in Madagascar will have less functionality then the same user connecting with his company laptop. Take your time to create the necessary profiles, for both users and endpoints.

- Single Sign-On : You can achieve this ! With SAML you can have your authentication and authorization information passed on to back-end website (your internal portal, a helpdesk application, a time registration application, …). This can bring huge benefits to the company. (More info on SAML : http://en.wikipedia.org/wiki/SAML).

- Connection : if choosing an SSL/TLS solution, think about how you connect it. The solutions usually allow single-legged or multi-legged configurations. I would opt for at least a two-legged config. The reason is simple. All traffic from the endpoints reach the box encrypted, on an untrusted network. My gut tells me you can not send the unencrypted traffic over that same connection into your internal network.

Conclusion
Either implementation costs money. In my humble opinion, SSL/TLS solutions bring more additional benefits then IPSec/L2TP solutions because they allow you to support a broader base of user types and in general be more flexible in allowing or restricting access to internal resources. If you choose SSL/TLS, think about the endpoints and how you can control them.

As a sidenote: Larry Pesce, from Pauldotcom fame, was one of the teachers and since I felt sorry that while he was only 2 hours away from beer walhalla, he only had Heineken to choose from, I brought him some tasty Westmalle dubbel.

I arrived late because traffic was bad just before a holiday weekend and I dropped into the SANS introductory presentation. All I remember from that was the lively discussion about the value of certification. Sorry, been there, done that, I’ve had 7 Microsoft t-shirts and lapel pins are great tools to learn kittens a lesson. What I’m really trying to say is that every cert has it’s value. Whether it’s a vendor cert, a SANS cert or a CISSP doesn’t really matter. The only guy that bugged me was someone who thought he had seen it all. You see that type of people and you immediately feel sorry for them because you just know they are on their way down. You’ve never seen it all dude, waving your business card with your unpronouncable title on it doesn’t make you ‘the man’. You’d like that, but it doesn’t. ‘The man’ is the person who works his ass off every single day without claiming the limelight. The limelight you’re revelling in, might get your ass burned, badly. Anyway, I disgress …

After the break it was time for Larry’s preso on Metadata, the silent lesson. You can find an up to date version of that preso on the pauldotcom website . Key points of this presentation were that metadata is really everywhere and there’s great fun to be had with. Looking at document metadata can teach you a lot of information about the persons or companies you’re investigating. I’ve done some testing before and what you can achieve with documents and photos from the web is really amazing. In short : really great preso, cleanly delivered by a very knowledgeable and skilled presenter. This is the kind of stuff you wanna see more often.

The last preso of the night was delivered by govcert.nl . While the presentation was build around a great concept, I think it ended up being a blow in the water. They bundled some of the results of their research into some kind of gameshow concept (odd one out) but unluckily it wasn’t really entertaining. Most of the challenges were geared towards a Dutch public while I felt the crowd at this event was more international and that’s the reason why they all fell in the water. Belgians, French, German and/or English people can’t tell the difference between Geert Wilders and a chimpansee, let alone knowing who he is. What I also missed was context. Why was this one the odd one out and what could’ve been done to prevent the data breach you meant to touch upon. Wait, there was some stuff about popups and boners that was really fun.

And there we arrive at a very big soapbox of mine. We, as Security Professionals, kinda love reading about new attack vectors, and we revel in the fame that becomes our part when we can come with something new. However, when you present something new, I expect you to do the following :

a) tell me what it is that is so special about what you found.
b) tell me how it works, what it does and obviously how I can do it.
c) and then it is your friggin responsibility to tell me how the f* I can protect myself from it.

It’s one thing to find a hole and I have lots of respect for researchers that do that each and every day.
The really great know how to educate.

That be all.

Stay Secure !

When reading the comments of users on the article, I was astonished by the amount of Dutch people that were frauded by selling items and accepting PayPal payments. The typical PayPal fraud scenario would like like this:

• A buyer (the counterfeiter) buys goods using PayPal
• The seller receives the money for the goods and sends the object the buyer bought
• The buyer lodges a claim to PayPal for a non-authorised payment that took place with his PayPal account
• PayPal transfers the money back from the buyer to the seller’s account without requiring consent of the buyer
• The buyer received the goods and didn’t pay for it
• The seller’s PayPal account is frozen; he lodges a claim against the buyer
• PayPal rejects the claim if the seller cannot provide all the receipts of sending the goods
• The buyer is frauded and cannot lodge another claim since PayPal only allows 1 claim per transaction.

I know when buying/selling goods online, making payments via website such as MoneyGram and Western Union is a no go, but these PayPal stories were new to me.

Read out the story on this page of the poor man who’s business went bankrupt by PayPay fraudsters.

3 statements listed on paypalwarning.com to remind users of the control you give to PayPal when using the service:

• Can PayPal hold my money with no explanation? The answer is YES.

• Can PayPal freeze my account for no reason? The answer is YES.

• Can PayPal take money out of my account without my knowledge? The answer is YES.

Personally I do have a Paypal account as well. I used it only once in the past, but as of now, i’ll think twice before I will commit into another PayPal transaction.

Check out other horror stories at:

http://www.aboutpaypal.org/
http://www.paypalwarning.com/

http://www.paypalsucks.com/

http://www.screw-paypal.com/

Here’s all the scam emails I received when responding to cars advertised on the gumtree.com.au website:

Re: Reply to your “2006 TOYOTA COROLLA HATCHBACK” Ad on Gumtree

from Emilio Narsete <emilio.narsete13@rocketmail.com>

The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. The resources provided by SAMM will aid in:

◊ Evaluating an organization’s existing
software security practices

◊ Building a balanced software security program
in well-defined iterations

◊ Demonstrating concrete improvements
to a security assurance program

◊ Defining and measuring security-related activities
within an organization

SAMM was defined with flexibility in mind such that it can be utilized by small, medium, and large organizations using any style of development. Additionally, this model can be applied organization-wide, for a single line-of-business, or even for an individual project.

As an open project, SAMM content shall always remain vendor-neutral and freely available for all to use.

http://www.opensamm.org/

“SABSA is a model and a methodology for developing risk-driven enterprise information security architectures and for delivering security infrastructure solutions that support critical business initiatives. The primary characteristic of the SABSA model is that everything must be derived from an analysis of the business requirements for security, especially those in which security has an enabling function through which new business opportunities can be developed and exploited.

The process analyses the business requirements at the outset, and creates a chain of traceability through the strategy and concept, design, implementation, and ongoing ‘manage and measure’ phases of the lifecycle to ensure that the business mandate is preserved. Framework tools created from practical experience further support the whole methodology.

The model is layered, with the top layer being the business requirements definition stage. At each lower layer a new level of abstraction and detail is developed, going through the definition of the conceptual architecture, logical services architecture, physical infrastructure architecture and finally at the lowest layer, the selection of technologies and products (component architecture).

The SABSA model itself is generic and can be the starting point for any organisation, but by going through the process of analysis and decision-making implied by its structure, it becomes specific to the enterprise, and is finally highly customised to a unique business model. It becomes in reality the enterprise security architecture, and it is central to the success of a strategic programme of information security management within the organisation.”

SABSA Model

The SABSA model is based on the Zachman framework for enterprise architecture, adapted with a security view: Each layer represents the view of a different player in the process of specifying, designing, constructing and using the business system:

• Contextual Security Architecture: The Business View
• Conceptual Security Architecture: The Architect’s View
• Logical Security Architecture: The Designer’s View
• Physical Security Architecture: The Builder’s View
• Component Security Architecture: The Tradesman’s View
• Operational Security Architecture: The Facilities Manager’s View

SABSA Matrix

The SABSA Matrix represents the whole model for the enterprise security architecture.

SABSA Framework for Security Service Management

SABSA Development Process

SABSA Lifecycle

SABSA Attributes

A list of business attributes compiled from extensive resources.

Official website: http://www.sabsa.org/

A whopping 40% of the used hard drives on eBay contain easily recoverable personal data. Use the following guide to ensure your personal data never makes it out into the wild.

Pretty scary words ain’t it… but it’s not far from the truth! Read the article to tutor yourself about the matter as you probably don’t want anyone to invade your privacy.

The first step in securing your data is bolstering your understanding of how data is stored and what happens when you delete it. Many people operate under the impression that when they delete a file it’s gone, as though they had torn a page from a book. But the way most operating systems handle such events is by simply removing the little marker that points to the file. That’s more like having information written on a chalk board in columns, each column labeled with a header, and then simply erasing that header to signify that column is “deleted” and available for future writing over. Anyone who looks at the board can read everything written in the column, until someone starts writing over it.

At the recent BlackHat Washington conference, a nice presentation was given about new man-in-the-middle techniques for SSL

The presentation starts with a good intro-primer on how SSL certificate validation works, continues with explaining how the old MITMs worked (including the trick with the intermediate CA which is used by most SSL inspection devices) and goes on with how it can be defeated now with stripping https or providing real valid https connections with ‘just’ a valid wild card certificate and some homo-graphic tricks.

The impact of this is not alarming in my opinion as there were already mitm tricks which worked. Attackers tend to stick to simple things that work before moving on. This is just an addition to the arsenal of tricks to fool a user into thinking his connection is secured. However, this might even trick the more experienced computer users and not only your mom who does a little online banking.

The presentation is worth a read because it gives a nice background on SSL validation, makes you think about website security architecture and makes you a little more paranoid when surfing the web in a public place.

This just shows once more that the cornerstone of SSL is trust. If you can come up with a way to get your malicious stuff to look trustworthy, it’s game over.

Bloggers are usually well aware of the dangers of being accused of libel, and that’s why most independent online journalists are very careful to make sure that everything they write about someone on their blog is backed with documentation and evidence. But when someone writes something libelous about you, you need to be well prepared to fight back hard.

So what can you do? Read the article @ makeuseof.com!

Sidenote
In November a Dutch waitress got “shut down” by a Belgian politician after comments about his visit to NY. I guess that’s the downside to the “libel” part, who’s the judge in right/wrong?

Yesterday, I bought a new wireless router for home. I was in the computer store to buy some DVDs and picked it up in more of an impulse. My old router was not performing well so I bought the first draft-n gigabit router I happened to stumble upon after quickly having verified that it was supported by dd-wrt.

Back home, I noticed that I was a little too quick in verifying the dd-wrt support. It will be supported by dd-wrt but currently it is still a work in progress. So I decided to use the stock Belkin firmware for now. However, one minute later, I stumbled upon a major problem in that plan. The little router does not support DHCP reservations which I need in my home network. I could offload DHCP to another small device in my network but I preferred to have the router handle it.

This leaves three options for getting DHCP reservations in the box:

1. cross-compile my own firmware (GPL sources and MIPS toolchain are available for download)
2. modify an existing Belkin firmware image by injecting extras in the image
3. hack into the router and modify configuration parameters to support DHCP reservations.

I decided to see what’s behind door number 3 and after a an hour or two I found two ways of adding your static DHCP leases to the device.

The first way is by modifying he configuration file of the device. You can backup the running configuration from the GUI and save it to your local PC. That backup file (user.conf) contains all nvram parameters to get the router configured. I noticed that it had quite the same parameters as my old linksys router. Especially the parameter static_dhcp_clients was of interest to me. After looking at the linksys example, I filled it up with my dhcp leases :

static_dhcp_clients=hostname1:192.168.20.2:001AAABBCCDD:1:hostname2:192.168.20.3:009988776655:1

After feeding it back to the GUI (restore configuration), the GUI told me the CRC was incorrect. Some trial & error learned me that the check was a CRC-32 (8 bit) check done over all the parameters. This checksum was put at the end of the file in hex. With this knowledge, I opened up my hex editor, changed the checksum, uploaded the modified configuration and after a reboot of the router, I had static leases working!

The second way I found is even easier. There is a hidden web page in the administration website : http://routerIP/wukongjiuwo.html. This is a diagnostics page which gives you web-form based console access to the device. In the console, the following command followed by a reboot should bring static dhcp leases in the box:

nvram set static_dhcp_clients=hostname1:192.168.20.2:001AAABBCCDD:1:hostname2:192.168.20.3:009988776655:1

If you decide to use some of this ‘wisdom’ on your own router, please do so at your own risk!

I read your piece discussing Mozy and thought you might be interested in
another vendor, SpiderOak. They provide a free, secure, automated approach for
storing, backing up, accessing, and sharing personal files. SpiderOak is the
only backup software to work across ANY platform (Mac, Linux, and PC) – it
also has unparalleled anonymity, there is literally no visibility into anything
being stored – not even SpiderOak employees have access to the data.

I must admit that I haven’t tried out SpiderOak, but it seems to offer the same kind of service as Mozy. So it’s only fair that I’d give it the same spotlight…

First of all: No I am not dead and yes I will continue to blog here. I just took a bit of a ‘blogging sabbatical’ the last couple of months.

That said, I (and many others so it seems) downloaded Chrome, Google’s vision of a web browser this week and played around with it for a while. A new browser always means new (or old) vulnerabilities and Chrome does not seem to be an exception to this. Google has a pretty good track record in following up on vulnerabilities so they will hopefully fix them soon.

On the positive side, it seems that Google really thought about security in Chrome by isolating processes for different tabs and enforcing a security model. They explain most of it in a cartoon you can find here.

Although I like the layout, the speed and the software design of Chrome, I will not be moving away from Firefox just yet. Even if all known vulnerabilities were to be fixed, there is one feature in Firefox which I think every browser should have and Chrome hasn’t: a decent password manager.

As a security conscious person, I use different passwords for each website I use on the internet. Unfortunately, I can’t remember all of them, so I store some of them in Firefox. I know I could use a tool like KeePass (and I do) but for most sites I find this overkill. Now what I like about Firefox is that you can specify a master password. Without this master password, you cannot unlock the password file (signons3.txt, passwords, and key3.db, the key, in your profile folder). This even survives a copy of the files. When you copy both files to another computer, you still have to specify the master password before getting access to the stored (encrypted) passwords.

Now back to Chrome. The profile data (in Vista) seems to be stored in C:\Users\username\AppData\Local\Google\Chrome\User Data\Default. There is an SQLite file called ‘Web Data’ in that folder and this seems to contain the URLs and (obfuscated) saved passwords. Since there is no master password functionality as there is in firefox, this file can be copied to another computer. Doing this gives the other computer access to all websites were there is a password stored for in the file (yups, I verified this).
This might not seem like a big deal but think about it. Every process running on your computer with the same rights as the user (or more) has access to these password storage files. This includes malware as well…

So I’ll stick to Firefox for now

The features of Mozy;

• Block-level incremental backup: After the initial backup, MozyHome only backs up files that have been added or changed, making subsequent backups lightning fast.
• Open/locked file support: Mozy will back up your documents whether they’re open or closed.
• 128-bit SSL encryption: The same technology used by banks secures your data during the backup process.
• 448-bit Blowfish encryption: Secures your files while in storage, providing peace of mind that your private data is safe from hackers.
• Automatic: Schedule the times to back up and MozyHome does the rest.
• New and changed file detection: MozyHome finds and saves the smallest changes.
• Backs up Outlook files: Disaster-proof email protection.

An the last thing… You get 2GB of free online storage space! This might help you to keep important data safe?!?

An article in Datanews (dutch only) today reports on the police arresting four ex-CCC members on two facts:

1. They were linked to a terrorist organization in Italy
2. They had ‘encoding’ software on their PC’s to securely wipe hard drives. (most likely the reporter meant wiping instead of encoding.)

On the first fact, I can certainly agree but with regards to the second fact, I did not know it was illegal in Belgium to have this kind of software installed on your PC.

I for one have Truecrypt as encryption software and Eraser as DoD compliant erasing software installed on my laptop. Am I a terrorist now?