Introduction

Sûnnet Beskerming Pty. Ltd. occasionally produces small reports that are for free (gratis) distribution. The free content may cover any area that Sûnnet Beskerming operates in. Examples may include generic security advice, specific security warnings, development practices, and application tuning. The only caveat on reuse of information from this site is in accordance with the following paragraph.

Use and reuse of information from this site requires written acknowledgement of the source for printed materials, and a hyperlink to the parent Sûnnet Beskerming page for online reproduction. Content from this page can not be reused in a commercial context without negotiating an appropriate licence with the site owner. Personal and educational use is granted without additional restriction beyond an amount in accordance with the principle of "fair use". Fair judgement is encouraged from site users as to what amounts to "fair use". Please contact us if you reuse our content, so that we may be able to provide more specific advice when necessary to improve your reproduction.

Sûnnet Beskerming do not normally offer services and products direct to the consumer, with this weekly column as the primary exception. One of the primary difficulties with a weekly column is ensuring that the content being reported remains fresh and relevant, even when it may be more than a week out of date at time of publishing. To remedy this situation, and to provide more timely information for people who desire up to the minute news, Sûnnet Beskerming is announcing the establishment of a mailing list which will provide up to the minute news on emerging threats, advice on good security practices, analysis and explanation of technical news items which may have an impact on your future IT purchases, and collation and distillation of multiple news sources to provide you with a brief, accurate, non-biased synopsis of technology trends, with a focus on security. Sûnnet Beskerming do not restrict the focus of their services to only one operating system or hardware platform, which allows you an equal level of service even if you do not run the leading Operating Systems.

Having as little as a few hours warning is enough to protect your systems against rapidly emerging threats. Some of the most prolific worms and viruses in existence can infect all vulnerable systems within a matter of hours, so every second counts. This is where having Sûnnet Beskerming services helps.

As a recent example, you would have been informed of the recent network compromise which resulted in up to 40 million credit card details being compromised a full 12 hours before it was being reported in the major Information Technology news sites, and more than four days before it was being reported in the mainstream media.

Sometimes we are even faster than Google, being able to deliver timely, accurate information before any related content appears in the Google search results.

Not many people can afford to be dedicated full time to searching and identifying this information, and so tend to find out once something bad has already happened to their systems. Let Sûnnet Beskerming use their resources to bring you this information before you find it out the hard way.

Sûnnet Beskerming are offering a free trial membership period for consumer subscribers to the mailing list (Businesses have their own, similar list, with added services). For subscription information, or more information, please send an email to info@skiifwrald.com.

Information Wants To Be Free - 18 July 2005

A lawsuit that has recently been reported on highlights just how much information trends towards being free over time. The Internet Archive project, and a law firm that was using the Wayback Machine for research purposes, is being sued by HealthCare Advocates. The concern is that the Internet Archive was illegally storing unauthorised copies of web pages in their archives.

While any number of Internet search engines store cached copies of web pages, the issue in this case is that the Internet Archive did not respect the robots.txt file present on the HealthCare Advocates site. A robots.txt file is a short text file placed in the top level directory of a website with instructions for web spiders and Internet search bots about which area of the site can be indexed, and those areas which should not be looked at. Some spiders do not respect this voluntary instruction file, and investigating the robots.txt file is an elementary part of web based hacking, as it provides the attacker with an easy indication of possibly sensitive areas of the site. Apparently the Internet Archive was not respecting the robots.txt file in place on the HealthCare Advocates site, although the evidence suggests that the robots.txt file blocking the Internet Archive was placed on the site following the start of the lawsuit and after the Internet Archive had already archived the pages.

Even with the robots.txt file and other systems in place, it is important to recognise that information will always move towards being free. Internet search engines will cache information long after it may have been removed from the active Internet, and specialist sites will cache / locally copy information that they feel is interesting. Placing information on a website on the Internet is a decision to distribute it, allowing infinite copies to be made of the information. In essence, it provides a tacit approval for localised copying of the information, even if instructions are given not to copy the information, such as through No-Cache headers in HTTP. No matter how well information is supposedly protected, nothing can effectively be done about the 'analogue gap' (or 'analogue hole'), where the information is rendered or otherwise presented for human consumption. If you can see it, it can be copied. Likewise, the best digital rights management solutions will always fail, due to this gap:

• Protected audio still needs to be decoded into a continuous stream for listening, and can then be recorded directly from the stream.
• Protected documents still need to be decoded for visual display, and can then be manually copied, or screen scraped to provide duplicates.
• Protected or streamed video can be captured following decoding by the video codec, or captured from a screen recorder.

A part of the problem comes from people who do not understand how the Internet actually works. There are people who still think that once they download something from the net, that it will not be available for anybody else, and that web pages are only sent out to the browser when a request is made, not available all the time - even if no one is looking at them, and when you close your browser the documents disappear. The difficulty comes in applying existing knowledge of data management and information replication to computerised and networked operations, almost all of the analogies used just do not work well. The problem with that approach, however, is that without the use of weak analogies, people with lower levels of technical understanding will never understand the technology, and this includes lawmakers, law enforcement, and the general populace. This approach leads to the legal decisions and lawmaking which appears counter intuitive to technically minded people, and misunderstanding of the application of such laws - such as the recent US Supreme Court ruling on P2P applications, which is still being reported as having made P2P applications illegal (which is incorrect).

Now that it is understood that information wants to be free, the idea of a national ID card system in Australia will, at one stroke, introduce the most desirable database for identity theft. With such an enticing database to criminals, it will only be a matter of time before it gets compromised, and the total database will be in criminal hands. It will be the greatest gift to identity theft. There will be naysayers who will deny that this is going to happen, but that stance is ignorant of reality. Last week's column provided an example where almost any personal information on Russian residents was available on the street, at public markets. The hacker arrested for breaking in to NASA and US Military systems claimed this last week that the systems were woefully protected, with one particular group of machines being installed with a blank administrator's password, allowing him to gain full control without actually needing any effort.

Although obscured in the PDF version of his indictment, the addresses of the attacked sites are fully visible when the information is copied across to another editor. This is merely the latest in a string of faux pas by companies and Government agencies that have failed to adequately obscure information before release. Another highly public example was the US report on the shooting of the Italian hostage following her rescue in Iraq. The full report was readable after copying it across to a text document, including the blocked out sensitive text.

Sticking with Australian news, an Australian man has been successfully found guilty for linking to sites which held illegal content (illegally shared music files). In addition, the ISP providing space and network connectivity for the site has been found to be a guilty party, as well. The case in question was actually mentioned a number of weeks ago in this column, and the ruling has now been handed down. In this case, the guilty party was knowingly linking to illegal content, and the ruling is in line with what the Dutch legal system seems to have taken in their approach, in that knowingly linking to illegal content constitutes an offence, but unknowingly linking to it does not.

This ruling actually has some pretty far reaching effects, if they are thought through. Search engines such as Google, Yahoo, MSN Search, Altavista, Sensis, and others, could be held liable for the sites that they archive in their indexes, as they must be aware that they are linking to illegal content as a part of their indexes. Already some foreign service providers are blocking Australian IP addresses from their services, though this is not widespread at this stage. This sort of decision is not actually without precedent. Major search engines have to prevent certain content from being presented to certain national IP blocks. For example, content relating to Nazis can not be presented to German web users, and the Great Firewall of China is designed to block content deemed unsuitable for Chinese web users, such as news articles critical of Chinese Government policy and actions. The adage that 'The Internet treats censorship as damage, and routes around it' is true, and this case will only result in a minor hiccup for the information flow dealing with illegal content. The multi-nation raids by law enforcement recently that shut down a number of warez servers (8 in total), will only result in a minor disruption of supply to the multitude of warez downloaders, as they adjust to alternate sources, and continue unabated. In the same way, shutting down sites hosting BitTorrent files which point to illegal content, will not work, as users adjust to sites located out of reach of the legal agencies chasing after them. A more practical example is spam email. Even with the US CAN-SPAM anti-spam legislation, the USA is still the source of more than half of global spam content. Relays in China are a popular choice for people who choose to operate out of reach of local law enforcement branches.

Related back to the original content on information wanting to be free is the idea of banning information. With the freedom of information that the Internet, and associated file sharing networks, provides, it becomes essentially impossible to filter all network traffic to proactively block content that has been banned, or is illegal. Actions taken by national classification bodies, such as the Australian Office of Film and Literature Classification, in banning movies or books automatically creates a demand for the banned content, as people seek to discover for themselves exactly what it was that got it banned. Likewise, attempts to ban or restrict access to information will eventually see it being set free by people who desire to handle the information, and who do not wish to see it suppressed. This can go too far, and descend into paranoia and conspiracy theory, and it only takes a cursory glance at major recent global events such as the September 11 events, and the invasion of Iraq, to see people who are endeavouring to free information, and those who have gone too far into conspiracy to claim that September 11 was co-ordinated by the US Government, although some of their other claims do appear to warrant further investigation. If it wasn't for people endeavouring to uncover information which others have tried to hide, the Iraq dossier would have gone unquestioned, the Downing Street memos would never have surfaced, and, going back in history, the Watergate affair would never have been made public.

With the above mentioned court case, the ruling has created an ironic situation, in that the published court documents have done more to draw attention to the illegal content, and advertised it wider than any of the efforts by the convicted parties. Some observers have suggested that the court be held to their own standards, and charged with the same offences for this action. Other observers have drawn parallels to the "Index Librorum Prohibitorum", the list of banned books by the Roman Catholic Church, which, itself, apparently is banned / suppressed, and by its very existence has created demand for the titles contained within.

In more positive news from the week, a 27 year old Chinese student has been arrested in Japan for hacking into a Tokyo travel agency's website and stealing personal data of about 90,000 customers. The breach happened back in March and was part of a wider spree which involved hacking into 14 business sites, and stealing half a million data entries. Apparently some of the data was on sold to unidentified parties, but it does not appear that any of the information has been used inappropriately ince its theft. The attacks were made possible through SQL injection attacks, a common form of Internet based attack against websites and web applications.

At the end of last week, the SpreadFirefox website, which is used to increase awareness of the alternative web browser, was subject to an attack via a published vulnerability in the Drupal Content Management System. Spread Firefox does not believe that any personally identifying information was compromised during the attack, and they believe that the purpose of the attack was to use the system for spreading spam messages.

In some fun news for digital rights supporters (not digital rights management supporters), an executive who believes the implementation of DRM solutions for his company's products is essential, has been caught out violating the DRM of another company in order to fix problems he encountered with their DRM and his ability to use their software. Although the position he was arguing from was that DRM that gets in the way is not the best form of DRM (so his stance on DRM hasn't really changed), the very fact that he took steps to violate existing DRM, and publicised the fact means that he appears to be wearing quite a bit of egg on his face. If he had stopped at the point of saying that poor DRM solutions are actually stumbling blocks to usefulness of a product, then nothing would have been out of line. The problem came when he took the next step and actually cracked the DRM implementation. The executive decided that HE was the one to decide that that particular implementation of DRM was not 'good', and because it didn't meet HIS requirements that it was okay to crack it for HIS needs. The problem with this approach is that he has placed his personal beliefs and convictions over what the law has set down, and it places him on the same level as every other 'pirate' who sidesteps DRM processes to get what they are after (such as music and movie downloaders).

More people are picking up on the adjustment by Microsoft's Anti-Spyware product with respect to the detection of Claria spyware. The default recommendation has now changed to Ignore, not Remove, which is causing rumours amongst various groups that Microsoft is losing the good faith that their Spyware removal product had established (prior to this it was one of the better spyware removal tools).

The Card Systems 40 million credit card breach that was reported on recently has moved into the news again, with a number of different groups claiming that they were the ones who were responsible for the fraud being detected and announced. This includes CardSystems, who claim that they delayed the announcement due to FBI request (the FBI deny this), MasterCard, who made the first major Press Release, and various Australian credit card providers, who claim that they alerted this breach back at the start of the year. Finger pointing and blame shifting is only going to get worse, as a couple of retailers are launching a class action suit against the major credit card providers and processors in an attempt to get them to accept liability for their actions, and provision of cards and services.

Keeping track and accountability of IT assets is an ongoing concern for a wide range of organisations and companies. The United Kingdom Ministry of Defence, in particular, has had a number of high profile losses in the past, and figures have recently been released that indicate that the various branches of the UK government have lost 150 computers so far in 2005. The Home Office is the greatest culprit, with 95 machines lost, and the MoD has lost 23 machines so far. Proper data management policies will mitigate the exposure of critical information through system losses, and companies should be able to identify what information is being stored on their systems. Unfortunately, history has shown that most companies are not aware of the information being stored on their various systems, and are unknowingly exposing themselves to potential exposure of this information (much like security of wireless access points).

An article on The Register discusses the significant issues caused by domain hijacking. A recent significant hijacking included anonymous webmail provider hushmail.com, while the sex.com hijacking is a famous case which took a lot of resources and time to resolve. The concern with domain hijacking is that seemingly legitimate domain transfer requests are sent to registrars seeking to move domains to new addresses. If successful, this then directs all website traffic to the new address, where the hijacker could be serving up malware, capturing visitor information, and denying service to the legitimate site. Domain owners should ensure that domain locking is applied to their registration, and that their registrar is to contact them via telephone any time that a change request is submitted. These efforts will not stop upstream transfers, but will stop most hijackings. Even if a site has been hijacked, the legitimate site will still appear at the original IP address, and can still be found via http://123.456.312/ , for example.

Infection Rates and Malware Evolution - 04 July 05

Thank you to the people who are becoming regular readers of this column - it is really making it a worthwhile endeavour to sit down and write them each week. Please don't hesitate to email with your questions or suggestions for future column topics.

To start off the column, there have been some fairly significant vulnerabilities uncovered recently in PHP, in the XML_RPC library which is a standard module for a lot of PHP installations. The ubiquitous forum software phpBB has fallen victim to this particular vulnerability, which appears strange, as recent versions were not susceptible, but the most current version (at time of writing) re-introduced the vulnerability. With the history of phpBB vulnerabilities, and remotely exploitable PHP vulnerabilities, it is expected that exploits will appear in the wild, with active attacks to commence in the very near future. Workarounds are available for site administrators, and it is expected that the main version of phpBB will be updated to fix this issue.

Computer Security company, Sophos, announced last week that the average time to compromise of an unprotected Windows XP system when plugged into the Internet is only 12 minutes. The ISC team at SANS argue that the infection time is more like 31 minutes, and others claim that it is as low as 6 minutes. Anecdotal evidence suggests that the time to compromise could almost be immediate, given the appropriate environment such as a hostile University network. As a thought exercise, it is possible to argue that infection rates are dependent upon infection mechanisms:

• Linear infection rates exist when manual human input is required for each infection, such as some website defacement attacks. This means that for any given period in time the same number of machines will be attacked and compromised, irrespective of the number of previous compromised machines.
• Exponential infection rates exist when automated attacks are the cause of infection, such as the Blaster and Sasser worms which affected default services on Windows. If it can be assumed that there is an unlimited number of new machines that are vulnerable to attack, then an automated attack will result in this sort of infection spread. Automated attacks lead to exponential infection rates as each infected computer contributes in launching attacks against new targets.
• In a real world environment, the infection rate is probably more like a modified Sigmoid function. A Sigmoid function returns a curve which looks like an 'S' and represents a near exponential infection rate initially, which then slows down in a near exponential decay. What this sort of infection rate represents is a rapid initial automatic infection which is then controlled and mitigated by network administrators and network protection tools. If it is being graphed as number of infected machines against time, it might look something like a bell curve, with a drop in total machines infected once the administrators find a way to defeat them. If it is being graphed as percentage of possible victims infected against time, then it will look more like the 'S' curve.

Some of the regular readers of this column include senior high school level Computing Studies classes, and the extended effects from the different infection mechanisms are left as an exercise to the reader - for example, consider the bandwidth issues when an attack consumes 100 KB per instance, there are 12 attacking machines on the network connection, and the bandwidth available is only 1.5 MB/s.

Some news organisations were reporting early last week that the US Supreme Court had set down a ruling that companies that created peer to peer applications were to be held responsible for the use of the applications to download material that infringed copyright. This interpretation of the ruling is actually incorrect. What the US Supreme Court established was that it was illegal to promote the application usage for copyright infringement / illegal activity, and that the developers could then be held liable in that instance for infringement by third parties that used the application.

A case developing in Australia along similar lines has seen two ISP administrators being sued for apparently ignoring peer to peer activity on their networks, and ignoring the infringement notices that were sent to them. The administrators are being sued on the basis that they allegedly maintained a Bit-Torrent hub that was used to exchange music files. An initial court ruling found that their actions were within the limitations of their job specifications, but that has been overturned, allowing the current action to take place. The legal team for the ISP claim that the customers were responsible for maintaining the hub, not the ISP. The reporting on the Supreme Court decision was fairly widespread, with a lot of differing opinions being presented, twisting the ruling to their own viewpoints. Representatives of online music downloading services went on record claiming that the ruling meant that the use of P2P software was illegal, but these reports didn't appear to refer to the actual ruling.

In fairly big news from the mid week, Pakistan's undersea Communications cable suffered a failure such that all Internet connectivity to the nation was severed (internal networks continued to function). According to the news reports, the failure was due a power failure. Secondary connections are being planned through India, and connectivity was maintained through backup satellite links, which could only provide 10% of the original bandwidth. There are quite a number of countries which make use of the cable, including India, Dubai and Oman. With repairs to take up to two weeks, it is possible that the UAE and India will encounter connection disruptions while the cable (SME-3) is fixed, as they also utilise the cable for connection. Pakistan was not the only country to encounter difficulties with undersea connections recently, when New Zealand suffered difficulties when rats destroyed a cable at the same time as a second cable was offline for maintenance, and last November the undersea cable supplying Colombia and Ecuador with their access was severed.

Microsoft is apparently in talks to buy Claria, a well known spyware company initially called Gator. Rumours abound as to what the likely outcome from this potential acquisition will be. One of the more sane suggestions is that Microsoft will be using the terabytes of personalised computer use data that Claria has acquired, along with the Google Adwords equivalent that Claria has hinted at developing, to aid MSN in 'catching up to Google'. Other rumours suggested that some Claria / Gator technology would be making its way into the next Windows release as a means to ensure only legal copies of the software get installed.

Staying with the Microsoft news, and reports are rising again of trojans that claim to be legitimate Microsoft patches. This issue has been reported on and off for quite a while, now, and it should be considered that this is an ongoing issue which will continue to plague whichever is the most common / prevalent Operating System. Other recent reports, again largely affecting only Microsoft systems, indicate that various malware are evolving in their ability to cause mayhem. One of the more recent evolutions in the dirty tricks war has been an ability for malware applications to identify and disable antivirus applications, firewalls, and other protective software. This is now apparently progressing to malware engaging in packet filtering. A packet is a small parcel of information that crosses a network, and many packets combine to carry the information that has been requested. In packet filtering, an application watches the network packets that go back and forth, and identifies certain behaviour / content that is of interest for subsequent processing. What the malware is tending to do is drop (do not allow to pass through) packets to and from antivirus autoupdate sites, or Operating System update sites. This behaviour doesn't tend to require modification of system files (such as the modification of host files which is a common technique), and is more difficult to identify and troubleshoot.