A Week For Security - 30 May 2005

Purdue University in the United States has reported its third theft of electronic information this calendar year. In this case, 11,360 past and present employees may have had their records accessed. Although smaller than a number of other security breaches reported this year, it is the latest in a disturbing trend of University breaches. In an identity theft case which used employees instead of system breaches to steal identity data, New Jersey police are reporting that the largest breach of banking security in the United States has grown to encompass at least 676,000 individuals. In this case, it was employees of banks who manually copied out account information which was then forwarded to a holding firm. Where a normal bank employee would be accessing 40 to 50 account searches per day, the accomplices were accessing ten times that amount. The data was being sent to a company which then sold the information to legal firms, private detectives and other third parties. The key difference between this case and the ChoicePoint breach reported earlier is that ChoicePoint obtained the data legally and sold to unknown parties.

A recent deconstruction of the Witty worm has revealed some interesting information about the possible source of the worm which was one of the fastest spreading Internet worms to date. The Witty Worm was targeted at systems that ran a specific firewall application from ISS, a security product vendor. Designed to disable the firewall, spread itself automatically, then overwrite sections of the local hard drive, the Witty worm was not only fast spreading, but actually possessed a malicious delivery payload. A flaw in the method used to generate new addresses to attack meant that 10% of the available internet address space would never have been attacked, as the addresses would never appear. A common IP address to all samples of the worm, even after observing the random address generation, indicated that the infection originated from a client system in a large European ISP. The attack from the worm targeted a number of systems at a US military base in Europe in the initial attack spread. The intentional targeting of systems at the US military base suggests that the creator of the worm had specific inside knowledge of the client list for ISS products. In addition, the use of an undisclosed vulnerability also suggests that the hacker had access to ISS or a security company such as eEye, and the unpublished research into vulnerabilities for that application.

The uniqueness of the vulnerability, which effectively could not be scanned for without exploitation, indicates that the rapid spread of the worm was due to a-priori knowledge of the install location for the affected ISS product, which would have been hardcoded into the worm. People claiming to be ISS company representatives, posting on various internet forums, believe that the author was an insider, but have not been able to identify them. Witty was unique in its ability to fit inside a single UDP data packet and not impede it's ability to spread, even with a malicious payload. For such a malicious, nasty worm it is quite a beautiful creation (in a horrid sort of way), and quite possibly indicates a new breed of malware creator, the talented, motivated malicious individual who is an expert at their skillset.

Continuing with the theme of the big bad Internet, an old extortion technique has resurfaced. A Trojan-downloading infection tool, known as download-aag or Pgpcoder, utilises known flaws in Microsoft Internet Explorer to retrieve the malicious content on to the local system. Once in place, the malicious tool actively searches the local system for files with certain filetypes (such as Word documents and Excel spreadsheets), encrypts them, deletes the original, then leaves a message demanding $200 USD for a tool to decrypt the documents. This technique was originally tried as the payload of a virus several years ago, but the weak encryption implementation was easily bypassed, and the financial extortion led to a concerted effort to track down the originator. The original site that hosted the malicious downloader has since been taken offline, but, as with all things on the internet, once the information is out there, it can never be removed. The other good news is that the distribution of victims has been small, and doesn't seem to be increasing significantly.

In online safety news, the Bank of America (BoA) has announced their new authentication technique, designed to reduce the effectiveness of phishing attacks against their customers. BoA are partnering with PassMark Security to provide this service to their customers. With more than 13 million customers accessing their BoA accounts via an online interface, the bank is claiming that the extra authentication methods are going to alleviate the risk of phishing attacks succeeding. The not so good news is that it only solves one class of phishing attack, that which is obviously a fake site. It forces phishers to become more technical in their approach to phishing BoA customer data, making their sites more difficult to sort out from the legitimate sites.

The name of the BoA solution is 'SiteKey' and is comprised of a known password authentication, along with secondary authentication of a known secret / image / human voice contact. Once a computer has been used for authentication it will remain authenticated for future contact, presumably from a specially crafted internet cookie. If a computer is stolen, this authentication mechanism would presumably not require re-authentication, allowing the thief to effectively bypass it. The additional system resources required for the storage of unique images for every customer would not be trivial, and forces users who browse without the use of images or visually impaired users to use one of the remaining authentication methods, weakening the apparent strength of the design. If there are not unique images for every customer, there is a finite chance that a phishing site is going to be able to guess the image when trying to authenticate to victims (if it doesn't already pass it through from the real site).

One of the key claims from the BoA site is that the 'SiteKey' solution allows users to validate that the BoA site is the real site, and not something fraudulent. This claim is false. At best, it gives the customer a better feeling about what they do with their online banking information without actually increasing the security. In real terms, it may actually decrease the security as customers become used to entering their account data into web pages that appear to be correctly implementing the 'SiteKey' solution. Encryption and information security guru, Bruce Schneier, has opined that these sort of attempts at improving security merely shifts the problem to other areas, and can only serve to frustrate legitimate users. The analogy that he uses is motor vehicles. As cars have become more difficult to hotwire and include more anti-theft devices, it forces the criminals to move from theft when the owner is not present, to theft when the owner is present and the antitheft devices have been deactivated. Thus, partially solving the problem of car theft when no one is present has led to the significant increase in violent carjackings as the thieves effectively bypass the antitheft systems.

The Esperanto Security Suite, as discussed in the column on Knoppix CD usage in banking from last month, neatly solves all of these problems, with a secure implementation of two-factor authentication which can not be spoofed.

Another online safety story from the week is news that the founder of a site designed to assist consumers in avoiding CNP Credit Card fraud, has fallen victim to the very fraud that he is trying to raise awareness about. This does not mean that his efforts are worthless, instead, it highlights how easy it is for this type of fraud to be carried out without a lot of interaction from the victim. CNP fraud is carried out when there is no need for the physical presence of the customer to process a credit transaction. Online purchases, telephone payments, and a range of other transactions can be susceptible to this type of fraud since they do not require a physical presence to enact the transaction. The lack of a verifiable customer signature for these types of transaction removes one of the security measures that exists in face to face transactions.

Further to last week's report about the Australian Democrat's bill before Federal Parliament about introducing fines for unauthorised installation of software on a user's computer, the US House of Representatives has recently passed similar bills, the SPY Act, and the I-SPY Act. While not passed into law, yet, the I-SPY Act allows for jail terms of up to five years to be awarded as punishment for an unauthorised breach of a computer system which is then used to commit another US Federal crime.

While two wrongs do not make a right, sometimes watching natural justice take its course is quite pleasing. Website defacers have recently gone after phishing sites with a greater rate of effort. Although there have been examples from 2003 where defacers have targeted phishing sites, it seems that there is a growing trend where the defacers actively seek to exploit the phishing sites. On one level, this is a positive thing, as it could serve to warn phishing victims that they are not visiting the legitimate site that they think they are. Although the site defacements may be the result of good intentions, this activity remains illegal. Overall website defacement on the internet is reported to have grown by 36 percent over the last 12 months, so the targeting of phishing sites could help divert the attention of those who deface websites from valid sites. Simple advice, which is still the best way to avoid losing data through phishing attempts, is to never give out personal or sensitive data in response to an unsolicited email, even if it appears to be from a company that you do have dealings with.

A recent court case in the United States of America may have widespread consequences for the use of encryption software by consumers. The particular case involved a prosecution for child pornography images, where the suspect was using the PGP application to encrypt certain communication. The judge ruled that having encryption software on a system was able to be ruled as relevant to the prosecution's attempts to prove criminal intent. The use of encryption software and tools is recommended for all computer users as it helps to keep private data safe from misuse in the case of unauthorised access to their systems. For most users, who will never be arrested, this is not a problem. However, for those users who might be arrested at some time for a computer related crime, the presence of any encryption software may be ruled to be relevant to the prosecution case for establishing intent.

Also of interest in the last several days is reporting that the CIA is running a paper exercise where terrorist attacks conducted by anti-American and anti-Globalisation groups are channeled through the Internet. Dubbed 'Silent Horizon', the exercise is designed to identify and theorise how government agencies and industry bodies might respond to escalating attacks and disruptions over the period of many months. The exercise is based on theoretical events happening five years into the future, so the infrastructure and capabilities of the Internet should not be all that different from the current technologies. The concept of an unannounced major attack against a specific group of interests has been mentioned numerous times by various information security figures, and has been dubbed a digital Pearl Harbour. The concept of a digital Pearl Harbour is similar to the surprise Japanese aerial attack which brought the USA into World War II. Essentially, a massive surprise network attack is launched and timed to use new vulnerabilities that have not been made public, with the goal of causing major havoc on a system or network. The digital Pearl Harbour concept has been considered extremely unlikely by a number of security researchers, and has not attracted a lot of mainstream attention as a result. Some forum commentators humorously opine that, while a digital Pearl Harbour might be nice, they are waiting for a digital Hiroshima.

In terms of overall threats, the threat of cyberterrorism is considered a lower threat than physical attacks against infrastructure. The unique nature of the Internet means that a 'cyberterrorism' attack could be anything from a dedicated hostile government, through to a group of bored teenagers, with the same results from either group. The real threat posed to systems is a source of frequent discussion, with various known criminal interests, rumoured military hacker units in North Korea (and possibly other countries), hacker groups, and bored teenagers all posing real threats to current infrastructure.

Criticism targeted at the exercise was largely centered around a claimed lack of imagination by the organising agencies. Critics felt that the exercise was too limited in scope and did not necessarily reflect what the situation might be like in the case of an attack. They also claim that the agencies fail to recognise and adequately prepare for what is happening today. The recent Cisco network breach was estimated to have been the responsibility of a single individual who then also managed to gain root-level access to more than half of the computers that they tried to penetrate in a two day period. Root level access allows them to do anything they want with a system, and once this is compromised, all assurances of data and system integrity are removed.

Unfortunately, there wasn't enough column space this week to cover the malicious software posing as a Window update. Expect to see it next week, along with a rundown on the effect that patent laws are having on the ability of companies to develop new and innovative software applications, unless, of course, more pressing news needs to be reported on.

Cisco Theft 12 Months On - 16 May 2005

Twelve months ago Cisco was the victim of a network penetration, which resulted in their IOS source code being compromised. The IOS is the operating system used by Cisco networking hardware, a large number of which effectively form the backbone of the Internet. At the time, there was little news about it, with only some minor reporting on various security and technology related websites. There was little information being made available, with the public reporting starting once a 2.5 MB section of code was posted to a Russian IRC channel. Cisco was keeping quiet, only confirming that they had a compromise, and the details were being left to the hacker, who posted a code sample to prove his story. The complete size of the code copied out was reported at 700 MB, including IOS 12.3 and 12.3t. Although the breach was not widely reported at the time, the New York Times recently ran a story purporting to describe how the network intrusion and compromise took place.

The author of the New York Times article was John Markoff, known for his novel CyberPunk and the Kevin Mitnick story. He is regarded as being responsible for the fear and paranoia surrounding Kevin Mitnick (a gifted conman who also had a decent level of technical skill). While he writes articles that are good reading, there are many information technology people operating in the grey areas of the law who regard him as being obsessed with money and story before factual reporting. In his defence, it is difficult to accurately report technical news in a non-technical manner, but his methods and reporting have been called suspect by the people he reports on (i.e. the people operating in the grey areas of the law).

John Markoff describes the mechanism of the attack as resulting from a compromised university network in Uppsala, Norway. Apparently a teenage hacker managed to exploit a known flaw in an application used to establish a SSH connection between computers. Basically, a SSH connection allows a user to log in remotely to another computer on which they have an account, and do so over an encrypted connection. With this application compromised, the hacker caught the login process from someone who was connecting to an internal Cisco system, which he then grabbed and used to eventually grab the source code to IOS. Eventually the hacker got caught, after he was bragging and taunting users on other networks that he managed to penetrate.

While the details may or may not be true, it does highlight how major security breaches can come from unexpected directions. Information security professionals, who are expected to be paranoid as a part of their job, fear about the network intrusions that are not reported, or never found. With increasing attention payed by organised crime interests to online crime, it is only a matter of time until a hacker, or group of hackers, refine their art to the point that they are effectively undetectable, and work to stay invisible with their crimes. It is possible that such capability already exists, but it would be impossible to know, as they would have made themselves invisible. Technically, it is not possible to be completely anonymous, however, practically, it is relatively simple.

Theoretically, if the hacker who had stolen the IOS source code had kept quiet, and not posted the sample, this probably never would have been reported on. If they had then gone on to find a set of major vulnerabilities in the source code, which they could exploit efficiently, there is no limit to the amount of damage that they could have caused to the Internet. Although the Internet is designed to be decentralised, and able to route around failures, an accurate attack on Cisco hardware would effectively cripple the Internet, especially if a corresponding failure was found in Juniper network hardware. This information could have sold for an immense amount of money to criminal interests or rogue nation-states. The power that could be wielded with such knowledge is almost beyond belief. Being able to pull the plug on the Internet for any country / agency / company at will would just be the start of it. Like any computer based attack, once it is used, it is in the wild and can be deconstructed and disabled. Using such a powerful weapon would also be a one-off, it is unlikely that the flaw exploited would last for long, and the attack source would be traced and wiped out by a number of very annoyed governments.

For the more technical readers who maintain an IDS of some sort, recent reports have indicated that one of the more popular security applications, Ethereal, has had two exploits made public. An IDS, and other related network analysis tools, can be amazingly useful to help administrators determine what is happening on networks of interest, and can be used to highlight malicious traffic as it starts to happen, so action can be taken before it destroys systems and networks. Because these tools can be used to detect major disruptions before they have a major effect, some malicious software aims to disable these tools as a part of the infection. A lot of malicious software is already designed to shut down firewall software, anti-virus software and other protective applications, before continuing with the remainder of the negative payload. The next major problem would be a 'killer packet'. Information being transmitted across any network is broken down into 'packets', transmitted, and then reassembled into a copy of the original information (much as parcels go through the postal system). A 'killer packet' is a specially created parcel of information that enters a network and is designed to disable any application that is monitoring network traffic, which then allows the rest of the malicious software through without being noticed.

Related to the recently reported issues with a Trend Micro anti-virus definitions file, Symantec's Norton Anti-Virus (NAV) on the Apple Macintosh OS X platform has experienced a similar problem, as reported by The Register recently. A recent virus definitions file update falsely identified the swap files (files on the hard disk used to augment the physical RAM in a computer) as containing "Hacktool.Underhand", and led to system crashes for some users. The NAV versions affected by this issue included:

• NAV 9.x with definitions file dated 28 April
• NAV 7.0.2 and 8.x with definitions file dated 1 June

Symantec advises current NAV users to update to the latest versions of the virus definition files, which have been corrected.

Microsoft just don't seem to have a lot of luck with the security of their delivered products. The Register reported recently on an online security competition known as 'The Gatekeeper Test' that Microsoft was running for people from Africa, Europe and the Middle East. While the concept of the competition was sound, and the questions appeared to be reasonable, the implementation of the test left a little to be desired. Users found that sometimes their responses were not accepted (a 404 page was returned), and in other cases users discovered that even if they had submitted an incorrect answer, use of the back button in the browser would allow them to try again without penalty. Apparently similar methods could be used to inflate scores above the maximum daily allowable points allowance.

After disabling the competition interface, Microsoft released a statement which described the source of the issues as being a technical malfunction in their server farm, when several servers lost state information (e.g. the total number of points for a particular user, or their progress through the test), however the test would be reinstated at a later time.

My AntiVirus Killed My PC - 02 May 2005

In rare circumstances auto-updating software, such as Anti-virus applications, can act as security weaknesses rather than strengths. Recently such a case occurred when the Trend Micro Anti-Virus application had a buggy identification file released. The culprit, version 594 of their virus definitions file, would result in affected Windows PCs slowing down significantly as their CPU usage ramped up to 99%, or greater.

This issue struck late on Friday afternoon, US time, after most personnel had departed for the weekend. This saved a lot of obvious heartache, as there were not as many end users as there otherwise might have been suffering from the slowdown. Unfortunately, however, this meant that a lot of administrators and other technical personnel were scrambling to diagnose, isolate, and repair the issues, costing them their Friday evenings, and into the weekend.

This is a practical example of why a completely homogenous environment, coupled with a lack of proper testing procedures, is a dangerous situation. The danger of completely homogenous environments, in particular those created by a monopoly presence, was elaborated in the now famous White Paper "Cyber Insecurity: The Cost of Monopoly". The paper specifically focussed on the potential for damage caused by the effective monopoly that Microsoft has, and how a 'monoculture', where one software provider, or one software type has absolute dominance, creates a single point of failure for a complex system.

A real world example where a lack of diversification caused a major catastrophe was the Irish Potato Famine of 1845 - 1850. In this case, the Irish farmers were only growing one primary crop, the potato, due to its dense energy storage and the best return per acre for any food available at the time. This also encouraged rapid population growth, as sufficient food was available to support the population density. Initially, airborne fungal spores from North America (via England) infected potato plants around Dublin, then rapidly spread to surrounding areas. As the infection vector was airborne, and the weather conditions were suitable for transmission of the fungus, the Irish potato crop soon failed nationally, and seed stores were destroyed by the fungus. Previous crop failures were limited in reach due to infection vectors being stopped by geography, different failure mechanisms, climate variations and so on. The complete loss of the primary food crop, linked with the exportation of the remaining food crops (cash crops), led to the mass starvation and emigration flows. Modern day equivalents are found in lesser developed countries, where cash crops are the primary agriculture and fluctuations in global demand and price leave countries vulnerable to minor shifts in the market.

Like the potato famine, failing to diversify your systems, or at least failing to properly test, quarantine, and protect against externally introduced material, will result in a single point of failure which can easily bring down whole networks. Not only is this important from an Operating System point of view, but also with the applications being run on them. While cost and effective interoperability concerns will limit the ability to diversify, an effective quarantine and test environment should be in place, before implementing any application on protected networks. Likewise, networks should be protected against external risks.

Several public system failures, particularly in Japan, came about as the result of the incorrect virus definitions file. East Japan Railways were affected by the recent virus definitions file problem, along with Osaka's municipal subway system, when various LANs went offline. A number of Japanese news services and the Tottori Prefectural Government were also affected, along with absentee voting for a number of prefectures.

The lesson to learn here is to always be careful with applications and Operating Systems which automatically update themselves, as they could be the vector for destroying your data or network.

If you are still looking for the April columns, they have been archived, and you can find them via the navigation link for Archives, on the left of the screen.