Information Security is a huge passion of mine, its more than just a job, its my way of life. I am sure to many people who are not as passionate, that’s sounds sad, boring and dull.

However, what if I was to talk to you about breaking into organisations, manipulating people to get information, and so much more. Sounds interesting, welcome to the world of Head Hacking.

Social Engineering is something many people have heard about, but we are clearly still not doing much about the people aspect of Information Security, and this is something we really need to patch.

Social Engineering, is different things to different people, but essentially its all about manipulation. There are many ways to manipulate people, but some of them are often overlooked, and maybe considered about out there. Social Engineering is something I enjoy, and linked with that are other passions which add many additional benefits. I am talking about Hypnosis, Neuro Linguistic Programming, Mind Tricks, Mentalism, Misdirection, Influence and more.

If any of this sparks some interest, then please visit and sign up to my new site Head Hacker. I hope to build this site into an interesting, topical and knowledgeable resource.

Thanks

Dale

EMV is used to secures the payment card transactions by authenticating the person and card. This is done with a combination of the authorisation codes, digital signature, and of course then the pin entry. Chip and Pin was introduced to reduce fraud with card payments, that previously relied on the signature on the reverse of the card for person verification.

They work of the guys at Cambridge University have identified and documented a flaw in the EMV process that allows a fraudster to make payments with a genuine card, without knowing the correct pin.

This obviously is a significant issue, and is not something specific to the issuing bank, but the card process in general.

Cambridge University have released a paper with information on their study, and it makes for an interesting read. Obviously it does not disclose the specifics, but I think a few of us will have some idea of how this functions.

Document Conslusion Extract:
In this paper we have shown how the PIN verification feature of the EMV protocol is flawed. A lack of authentication on the PIN verification response, coupled with an ambiguity in the encoding of the result of cardholder verification as included in the TVR, allows an attacker with a simple man in-the-middle to use a card without knowing the correct PIN. This attack can be used to make fraudulent purchases on a stolen card. We have demonstrated that the live banking network is vulnerable by successfully placing a transaction using the wrong PIN. The records indeed falsely show that the PIN was verified successfully, and the money was actually withdrawn from an account. Attacks such as this could help explain the many cases in which a card has supposedly been used with the PIN, despite the customer being adamant that they have not divulged it. So far, banks have refused to refund such victims, because they assert that a card cannot be used without the correct PIN; this paper shows that their claim is false. We have discussed how this protocol flaw has remained undetected, due to the public specifications being not only complex, but also failing to specify security-critical details.
Finally, we have described one way in which this vulnerability may be fixed by issuer banks, while maintaining backwards compatibility with existing systems. However, it is clear that the EMV framework is seriously flawed. Rather than leaving its member banks to patch each successive vulnerability, the EMV consortium should start planning a redesign and an orderly migration to the next version. In the meantime, the EMV protocol should be considered broken.

Obviously this is not good, it is however concerning to read that people who fall victim to these sort of attack are not being reimbursed for their loss.

These guys have done some good interesting work, I just hope the industry takes this on board and makes the appropriate improvements.

They have put together excellent information on the art of social engineering, and have formed an awesome framework with input from many great people. I am sure alot of people have read it, as I have heard people in the industry talking about it, but I dont often hear people talk about the Social Engineering Tools.

In particular I am talking about SET (Social Engineer Toolkit).

The Social-Engineering Toolkit (SET) is a python-driven suite of custom tools which solely focuses on attacking the human element of penetration testing. It’s main purpose is to augment and simulate social-engineering attacks and allow the tester to effectively test how a targeted attack may succeed. Currently SET has two main methods of attack, one is utilizing Metasploit^[1] payloads and Java-based attacks by setting up a malicious website that ultimately delivers your payload. The second method is through file-format bugs and e-mail phishing. The second method supports your own open-mail relay, a customized sendmail open-relay, or Gmail integration to deliver your payloads through e-mail. The goal of SET is to bring awareness to the often forgotten attack vector of social-engineering.

I have heard good things about the tool, and ReL1K (David Kennedy) has done a cracking job of putting a nice tool together.

So if your running a Linux distro and you want the tool, you can get it by simply fetching it “svn co http://svn.thepentest.com/social_engineering_toolkit“. For this basic demo I am using Backtrack 4 Final, so its already good to go. SET has various options, and can be configured in various ways. If this post is popular I will put something together to show this. However this post is just to demonstrate a basic function, and to show how well it works, and how simple it is to use, so that others are encouraged to give it a try.

So this is the situation. We are going to replicate a website, in this case I am going to use Twitter as an example, we then will use some social engineering techniques (not demonstrated) to encourage our target to visit a site / ip we have setup, and then we are done. There is spear phishing capabilities in the SET which will obviously provide a more automated attack vector, but for this demo we will assume its done manually, or verbally influenced / encouraged.

So we are in our chosen Linux distro, connected to the Internet / Network, and we make sure we have an IP address assigned. I am demonstrating this in my virtual lab with a BT4 Final Box and XP Sp3. I have also tested this same method on a physical BT4 box and a W7 box, with the same results.

So I assign an IP via DHCP.

Then we navigate to our folder that SET is installed to. In my case its /pentest/exploit/SET/

Next its always good practice to make sure everything is up to date. ReL1K is an updating machine, so it pays to check So we simply type ./update_set and its confirmed I am good to go. You can also update within the SET tool, and as metasploit is also used here, its worth making sure you are all up to date there also.

Now its time to get down to business and kick of SET. We simply type ./set and away she goes.

As we can see SET has a few options at its disposal. We are going to take a look at the Website Attack Vectors, so we want option 2.

Again more options are available. Because we are lazy we will let SET do the hard work and clone and setup a fake website. So again option 2.

We now need to select our attack vector. I know my lab machines are fully patched, so a browser exploit will most likely not be successful. So we go with option 1 and a Java Applet Attack method. Then remember we said we shall clone Twitter, so we input www.twitter.com also.

Its now time to get our payload selected. I am a fan of reverse TCP meterpreter, so time for option 2 again.

Now we have the fun of encoding our payload to bypass AV. Shikata ga nai is an excellent encoder, but now with have the multi encoding option, I have found in my tests it can be more successful at bypassing the AV. So you guessed it, option 15 please We will also need to define our listener port, so we will go within something creative. 4321

The encoding mojo does its thing.

We are asked if we want to create a Linux / OSX payload, but we dont need this here. So no thanks. The tool then goes ahead and sets up our fake site, and gets our listener up and running.

So now we have cloned a site, defined a payload, encoded it for AV bypassing and setup a web server for our cloned site. Simple huh. So now we are ready and waiting. So now we just need someone to go to our cloned site.

So I convince myself It would be a good idea to go to Twitter on a strange IP.
So we enter the IP of our SET hosting machine, and oh look its Twitter. Damn I need to install some Java stuff (I believe this can be customised for a better convincer, remember we are doing basics here It involves some more work and configuration.)

So we say yes, and assuming the AV bypass does its thing, we can see a session is created, and we are directed to the real Twitter site.

We connect to our session, and voila we have shell. The games begin.

So there we have it,  a doddle right. A great job has been done on this tool to make it effective and childsplay to use. I think it has a place as part of a pentest engagement, but also an effective awareness tool in anyones organisation to demonstrate how these things happen in reality.

It is of course worth mentioning, that not all AV’s can be bypassed by all encoded payloads. In my testing I found that I was able to bypass Avast, but Microsoft Security Essentials was picking this attack up. I didn’t mess about to much with different encoding variations, but you get the idea.

To demonstrate this to hopefully some better effect, I uploaded the file to Virus Total for analysis and you can see the results below. Less than half of the AV’s used can make the detection.

Microsoft ships its OS with Internet Explorer, and some people are not happy about this, so things need to change. The answer is a selection screen so users can choose from a selection of other browsers easily.

So if you keep your machine up to date your going to see this High Priority Update (KB976002).

Once this update has been applied and you reboot your machine and you open your beloved Internet Explorer (assuming its your current default browser) you get taken to http://www.browserchoice.eu/BrowserChoice/browserchoice_en.htm where you get presented with various options of browsers to install and use. Its not clear to me how this will be displayed on all users machines, so this is just my experiance.

The browsers up for grab are – Avant, Chrome, Firefox, Flock, Green Browser, Internet Explorer, K-meleon, Maxthon, Opera, Safari, Sleipnir, Slim.

Personally I dont think this is going to make a great deal of difference. Most people who are tech savy will be using another browser if it suits them, and those that are not will most likely stick with what they know given the choice.

Time will tell in the future, once more stats come out in the next few months.

Well now there is another version… Security Essentials 2010. Its not so much about cleaning up your system, its more about the screwing up your computer and charging you for the privilege. Its the usual scamware type software we have seen before on the AV front, but this one seems to be rather successful with such a similar name to Microsoft’s offering.

Below are some screen shots of the scamware, and the real Security Essentials offering to help you tell the difference. Remember, if its asking you to pay, then step away.

The real Microsoft Security Essentials:

Fake Security Essentials 2010:

If you have been unlucky enough to install this scamware, then you may notice you are unable to visit any of the common legitimate AV software vendors to help clear up your system, as well as other popular sites that you may visit. I would recommend you use another computer to download a free AV solution like Microsoft Security Essentials or Avast and then install on your computer to clean it up.

So for now, remember if its to good to be true, it usually is.

If you going to be in the Earls Court London area on the 27th April, and your a security blogger, then the Security Bloggers Meet Up is going to be the place to be.

An excellent time was had by all last year around the same time as RSA, and I hope this event to be as good if not better.

So if your interested, check out the site and follow as this progresses and register your interest.

Hopefully see you there.

Last year (2009) I got a call about reviewing a Full Disk Encryption product called DESlock+. I had not heard of the product, so a quick search later and more information was revealed. As encryption is an import consideration for users at home and within an organisation, and I had been looking at a few vendors for my day job I thought it would be some time well spent, and may be of use to some of you guys.

DESlock+ Enterprise is the product I am going to be look at, and its made by a company called DES. DES were founded in 1985, and the companies systems and methods originated within the British Government Communications Headquarters. The original users of DES products were government based, but over time have spread into other sectors. Over the past twelve years DES has also marketed the DESkey and DESlock range of software protection products. With an estimated 500,000 units in use throughout the world to date, sales of the DESkey continue to grow.

• Full Disk Encryption
• Removable Media Encryption
• Encrypt Email, folders and files
• Multiple encryption keys stored in a keyfile
• AES, 3DES, Blowfish Algorithms
• Encrypted mountable files
• Secure data shredder
• Keyfile backup utility
• Scalable centralised licence and key management
• Remote keyfile distribution
• Software feature policy control
• Includes DESkey USB manager tokens

When reviewing encryption products its can often be a difficult task. Lets face it the most important thing an encryption product can do is encrypt, if it doesn’t do that then we are in a pretty bad situation. So you will be happy to hear DESlock+ does encrypt and it works in a no nonsense way so with that in mind we are off to an excellent start.

To speed up my review Jamie Gordon (excellent guy) sent me a Windows 7 Virtual Machine with the DESlock product pre-installed, as like everyone getting the time to have a look at a product can be difficult. So the starting situation is essentially this. We have a Windows 7 client machine that has DESlock+ installed, and connecting back to DES HQ. The client gets its policy applied when we start up and authenticate for the first time, and we have various options available to us, but the Full Disk encryption has not yet been applied, our friend Jamie takes care of that for us remotely later.

I have a hell of alot of screenshot, about 120 or so, obviously I don’t want to post all of these, so as part of this review I will give an overview of whats going on, various configuration and functional options. I can tell you now the best thing for me about DESlock+ is it does what it says on the tin, with no fuss, and you don’t need to be a rocket scientist to configure your policy and get it up and running. I will basically show the shredder options, encrypting individual files, removable media and of course full disk encryption.

So to get things started we boot up our VM. Its important to remember that normally in an enterprise environment you would normally be logging onto a domain, however in this example this is not the case. So any credentials are not resolved from my domain credentials, its needs to be done manually. So I need to authenticate myself with the DESlock+ Enterprise Server using a one time password to get things started.

Once authenticated we need to change the password.

So now we are presented with the Desktop to go about our daily duties. Its worth noting we have the features of DESlock+ available to us now, but we have not yet had our hard disk encrypted.

So everything looks as normal, although we have the DESlock+ Shredder, and a couple of new icons in the task bar.

I will add a picture montage at the end of this review that shows various screen shots, so if you want to know what happens when you look further at these properties you can check them out.

So lets see what happens when I plug in a USB stick (A Dell branded 64Mb in this case). DESlock+ detects the USB device and prompts to do its thing.

So lets kick off the removable device encryption.

Encryption Completed.

Once the drive was encrypted a put a couple of files on there, ejected the drive and tried the stick on a windows machine, linux and Mac. All found the drive to be unreadable, so no chance at getting at that data. So good stuff.

So next I decided to decrypt the drive, and then try just encrypting a single file.

So now we create a file, and right click for our encryption options.

Once the file is encrypted the remainder of the stick was still usable, but as expected the encrypted file is not accessible. Obviously files can be encrypted like this locally, as well as on removable media. This allows for some versatile application, whilst ensuring control and protection over your data.

Of course for that little bit of additional protection its a good idea to securely erase files when your done with them, and this brings us along to the DESlock+ Shredder. You can choose how many passes you want to make when erasing the data, and choose between two methods.

So we know we can encrypt our files as needed, and we can securely erase them also. So the next thing to get sorted is obviously full disk encryption.

There is an option to encrypt using a local wizard, and an activation code you get from the administrator. I did have a look at this option as the screen shots below show. However I decided to go the remote route as this is an enterprise offering, and see how it works from the admin console.

As you can see above. If we had an authorisation code from our admin, we could kick off the full disk encryption ourselves.

So now lets take a brief look at what we see as an administrator from the DESlock+ Enterprise console.

Once we are in the admin console we have access to the various configuration options. We have the ability manage both DESlock vouchers (these control what you can or cant do based on what you have purchased) and users of the system. From a day to day perspective this is probably where you will spend time verifying what accounts are created, active machines and so forth when your first getting set up. Then there is the profiles section, this does what it says on the tin. It allows the for creation, modification and assigning of encryption profiles. Next is the Enterprise server section, this shows the user details and associated machine, when they last connected, keyfiles in use etc. The full disk encryption section is fairly obvious, this where you manage the FDE of machines in your environment. We then have the encryption keys section, this is a useful section as you can create multiple encryption keys for different parts of your organisation, to give extra levels of control. Finally the install admin section, this pulls various information together to form a registry key that is applied as part of the product install on client machines.

I viewed this section remotely with the DES guys, so I didn’t have time to have a proper play myself, but I did take some snapshots that you can see towards the end of the review.

So whilst viewing remotely, Jamie kicked off my remote encryption of my VM machine. It worked a charm with no fuss. My machine connected with the remote server, downloaded configuration updates, and then started encrypting. I even rebooted mid encryption as a test and it resumed once logged in.

So here are a couple of snaps to show what’s going on at the client end.

Now lets reboot.

Job Done

Wrap up and thoughts….

So we have gone through the motions, seen some screen shots, but is it actually any good. Personally yes I think it is. For me when it comes to encryption products it can be a difficult evaluation process, because lets face it if its encrypting our data in a secure method its ticking the box. I think what makes DESlock+ a good product is that its simple. I don’t mean that in a negative way at all, the product does what it says on the tin. It encrypts files, removable media, full disk encryption as well as emails and other bits and bobs I was not able to spend time in testing, and it does it in a professional no fuss approach. The menus and clear and simple to understand, policy configuration is easy and flexible, I like the fact you can use different encryption keys in different parts of the business, and for different users, this gives an extra level of access control. I like how easy it is to revoke access to encrypted files and devices in the event of loss, and I like the challenge response stuff for when people forget passwords and I like the secure deletion with the shredder.

I would certainly make organisations (especially SME’s) I work with aware of DESlock+ as well considering their similar home offering to family and friends who just want to encrypt files and don’t need FDE. However as with everything I had a few gripes with the product whilst reviewing. Its great that you can encrypt removable media, but its abit frustrating you cant share the content with non DESlock+ customers (they now have an offering for this coming soon), and I have seen some other products that allow custom configuration messages for users screens, this isn’t a major one for me but its a bonus sometimes. Lastly its my understanding that the product itself does not support distribution across the organisation, so you need to utilise some other tooling to package up and distribute DESlock+. None of this stops me thinking its a good tool, just sharing my thoughts. It is also worth noting the DESlock+ products only work on W2K upwards, so no support for Linux and OSX.

Since I have completed the review DESlock+ has been FIPS 140-2 validated, so congratulations and well done to the guys on that achievement. They have also made a product available called DESlock Reader which will allow non DES customers to decrypt emails, and files that have been encrypted with DESlock+ (obviously you will need to know a pre shared password to decrypt), this something that can be enabled or disabled at a policy level if you don’t want everyone having the ability to potentially share data outside the organisation. Another product is in the pipeline that should be out later this month, and this is DESlock+ Go. This product is all about encrypting removable media to share with 3rd parties in a secure manner. The 3rd party doesn’t need to install any software, it all runs from the encrypted package, and if its writable media such as a USB device, the 3rd party can even write data back to the device to share securely back with the original DES user. Finally they also have an MSI configuration in the pipeline that I think will help with the installation and distribution of the product, especially in larger enterprises.

For pricing your best of contacting DES yourself, but its my understanding the Home versions are about £45, which just provides secure file encryption (not FDE). Business Desktop licences start at around £75 for small numbers of licences and then decrease in cost as the number of users increases over 1000, and the Enterprise Server is about £250. Maintenance is also available at additional cost as needed.

Picture Montage

]]> http://blog.securityactive.co.uk/2010/02/09/deslock-enterprise-review/feed/ 0 http://blog.securityactive.co.uk/2010/02/05/information-commissioners-view-on-using-personal-data-for-system-testing/ http://blog.securityactive.co.uk/2010/02/05/information-commissioners-view-on-using-personal-data-for-system-testing/#comments Fri, 05 Feb 2010 16:13:10 +0000 Dale http://blog.securityactive.co.uk/?p=1027 Following on from my recent post on “Doing the right thing when testing with production data“, I was discussing my frustation with a colleage at work and they told me to take a look at a copy of the the “Data Protection: Guidelines for the Use of Personal Data in System Testing” document. We had an old copy, and this is a statement from the ICO, in 2003 I believe. There is an updated 2009 version, but I dont have access to this, so I am unable to comment. Either way its a useful snip it to share with everyone.

The Information Commissioner’s view
The ICO advises that the use of personal data for system testing should be avoided. Where there is no practical alternative to using ‘live’ data for this purpose,
systems administrators should develop alternative methods of carrying out system testing. Should the Information Commissioner receive a complaint about
the use of personal data for system testing, his first question to the data controller would be to ask why no alternative to the use of ‘live’ data had been found.
Key risks in system testing There are a number of general risks that exist whenever system testing is undertaken using live data and/or a live environment.

These are as follows:
• unauthorized access to data;
• unauthorized disclosure of data;
• intentional corruption of data;
• unintentional corruption of data;
• compromise of source system data where appropriate;
• loss of data;
• inadequacy of data;
• objections from customers.

There will of course also be sector-specific risks peculiar to each individual business, each type of business and each particular system.
Before commencing any system testing, it is advisable for the data controller to undertake a risk assessment identifying the nature of the risks that apply, their
possible impact and planned handling strategies.

A cautionary tale
The view is sometimes expressed that system testing poses no real data protection problem, as it takes place all the time with little apparent detriment
to individuals. The following case study, which is based on a true complaint received by the Information Commissioner’s Office, shows that the use of ‘live’
data to test systems can indeed cause very real problems for individuals. A pupil was away from home at boarding school. The pupil’s parents received a
letter from the local hospital informing them that their daughter had been involved in a road accident. In fact, there had been no accident, but the hospital
had been using live patient data to test a system for sending out letters to patients.

So with the fact that organisations still seem to be lacking, VISA and MasterCard are apparently taking steps to up their game and apply some more pressure / persuasion. I know what your thinking, most likely the same as me. We have heard it all before, and with disclosure being the way it is we dont get to hear about it anyway.

So what does this mean. Well the fines are starting to flow, many organisations are being fined (apparently a little under half a million a month), as well as taking steps to prevent acquirer hopping which is common if an organisation is getting to much hassle, they simply jump ship to another. Now if organisations are suspected of doing this to dodge regulation they are effectively black listed.

Of course I cant prove this is happening, same as no one else can because disclosure laws dont allow for it, and companies are not going to be actively publishing this on their sites, and customers I have worked with obviously share information under NDA.

All you can be sure of is the fact that companies are making progress, but its slow and non impressive, and obviously isnt a big enough priority. To provide encouragement fines are and will continue to be handed out, and they will be increasing. It can sometimes be hard to find out about the fines, so here is the current schedule of fines, correct on 2nd Feb 2010.

Fines are represented in US Dollar and Euro respectively

MasterCard fines for non compliance are:

Level 1 & 2 Merchants

• First Violation – Assessment Amount: Up to 25,000
• Second Violation – Assessment Amount: Up to 50,000
• Third Violation – Assessment Amount: Up to 100,000
• Fourth Violation – Assessment Amount: Up to 200,000

Level 3 Merchants

• First Violation – Assessment Amount: Up to 10,000
• Second Violation – Assessment Amount: Up to 20,000
• Third Violation – Assessment Amount: Up to 40,000
• Fourth Violation – Assessment Amount: Up to 80,000

Visa expects level 1, 2 and 3 merchants to demonstrate that they are actively engaged in the programme to become compliant. A merchant will not be at risk from Visa fines for non-compliance if they are compliant with milestones 1-4 of the Prioritised Approach