'Tis a Fragile Thing - 31 October 2005

After the peering point between the two US Tier 1 ISPs, Cogent and Level 3, was recently cut (see columns from two and three weeks ago), it started a lot of people thinking about the fragility of the Internet, and what could happen in the future if the gentlemen's agreements that keep the backbone operating cease. A little over a week ago, an unintentional outage affected a large number of American Internet users. Tier 1 ISPs Verio and Level 3 were affected this time, with routing services going awry, effectively making their complete networks vanish from the Internet.

The actual equipment that makes up the core of the Internet, the network routers, rely upon routing tables to direct the traffic that flows through them. These tables are like mini network maps, and allow the routers to pass the information to the appropriate system so that it can be passed to the destination as efficiently as possible. In the recent outage, it was claimed by Level 3 that a software upgrade had damaged the routing tables, which resulted in the effective blockage of the information that was passing through their network.

Technically, the routers started to 'flap' as they cycled between two invalid routing tables in a vain attempt to get the traffic they were holding to a valid destination. As routers went offline, it started a cascading failure, with more routers unable to pass traffic to a valid location, which then forced them to flap between their alternate routing tables, which also became invalid, taking them offline as well. The total outage was around 2-3 hours, as by that time other routers had updated their tables to route around the Level 3 and Verio networks, and the Level 3 systems were being brought back online. The remaining network segments would continue to carry increased load until the full systems could be re-established.

While this is the second time within a month that Level 3 have been involved in a blackout of a portion of the Internet, they are not struggling to keep up, just yet, but they are reported to be suffering financially even with a stable revenue and customer base. The bigger problem is for the lower-tier ISPs, who had to explain to irate customers that the Internet was down (as far as they could go), and that there was nothing that could be done about it. Unfortunately, their reputation and reliability would have taken a hit, and it is possible that these ISPs have lost customers as a result.

Some observers claim that these recent events are strong cases for ensuring that network access for large companies is 'multi-homed', which means that their network traffic can pass through a number of Tier 1 providers when it arrives on the Internet backbone. This allows for continued network access in the case that one of the Tier 1 providers suffers an outage. Selection of a multi-homed ISP as the network connection for end users will also help maintain network connectivity in the case of an outage.

When the Internet is up and running, one of the increasing uses for it is online banking / financial transactions. The US Federal Financial Institutions Examination Council (FFIEC) has recently called for US banks to have implemented two factor authentication for online banking, by the end of 2006. It is expected that the most common implementations will probably be a variant of the key fob model, as applied by RSA Security's SecurID, or a one-time password model as applied by a number of European banks.

Concerns have been expressed about the cost and reliability of these added features, and whether the costs will be passed through to the consumers in the long run. The security of most methods has also been called into question as both methods of authentication will travel over the same channel (i.e. the Internet). This single channel of use still allows for spoofing attacks (phishing), where the attacker needs to position themselves between the bank and the user, pretending to be the user to the bank, and the bank to the user. Until recently, it was considered impractical to perform this sort of attack against the newer two-factor authentication models, however a successful phishing attack in Europe has shown this to be false.

Proper two channel methods, such as using SMS or voice calls, introduces significant overhead to the transaction process, which ultimately is likely to be passed on to the client, and can still be bypassed through social engineering or the theft of the mobile (one of the most commonly lost / stolen personal items).

By making random capture of this information more difficult for attackers it makes it more likely that any time that the security model is breached the banks will blame the victims for failing to apply the security model correctly. While an increased level of personal responsibility will go a long way, it is still important to consider that attackers can still operate happily. Human nature being what it is, any time that access controls are tightened, more people will go out of their way to make their access a little easier. That might mean taping their password to their key fob or password sheet and carrying it with them everywhere (all they need to do is lose it / get mugged).

Cynical observers have pointed out that it may not be for the best interest of the consumers (that is only a happy coincidence), and that it is the insurance behind the banks (FDIC) that is pushing for the improved security models, ostensibly to protect the financial institutions against the losses. Unfortunately, the methods only improve the complexity of the required attacks by a minimal level.

It is also highly likely that this will see a new form of phishing attack introduced, the real time attack, where the attacker is actively manipulating the account while the user is trying to log in (a derived man-in-the-middle attack).

Liability? What Liability? - 17 October 2005

Many industries and professions have strict liability and accountability regulations, which can significantly increase the costs of doing business, and which provides a place to assign responsibility should something go significantly wrong. Strangely, the software development industry tends to avoid liability for errors in generated software. The Therac-25 is one known example where software errors can be directly linked to human deaths. Likewise the flight control software in early Airbus fly by wire models could be argued to be responsible for human deaths (although it can be counter-argued that it was the human error of not knowing the software operating boundaries which caused the fatal crashes). In the End User Licence Agreements (EULAs) that are presented to the user before initial installation or use of software, software vendors will tend to claim that they have no liability or responsibility for the effects from their software on the end user's system.

Mentioned in columns in May and August, EULAs can introduce problems for end users / clients of the vendor. While end users can shoulder some personal responsibility for acquiring and installing the software, who is to be held responsible for vulnerabilities and exposure to risks from flaws in the software? As mentioned above, the software vendors sidestep this liability through the use of the EULA, at least for consumer level software. For the right amount of money, vendors will develop software to appropriate standards, and provide a level of accountability for flaws within it. It is essentially offering insurance for problems caused by flaws in the vendor's own software. Going further, and for even more money, it is possible to develop software which is near-perfect, and which the vendor supports completely.

The problem with the above argument is that the market has set its own baseline for what is an acceptable level of software performance and stability, which is unfortunately quite low. Better software takes time, and by the time that a polished application is ready, it is highly possible that the market has already been saturated by sub-standard offerings from other companies. While it is fashionable to complain and whine about the vulnerabilities in commercial software, the market only has itself to blame, forcing the current situation when it chose the lower priced vendors.

Discussion about where liability rests for software vendors has come at an opportune time, with Microsoft releasing their October Security patch updates last week. With nine patches released, it is strongly recommended that all people who use Microsoft Windows update their systems as a matter of extreme urgency. A number of the vulnerabilities can be remotely activated to completely compromise a vulnerable system.

Exploit code is already circulating for some of these recently patched vulnerabilities. Initially it had been reported that exploit code was already developed at the time of patch release, but it was contained to one or two online locations. Exploit code has escaped this boundary, and is starting to appear in numerous locations. It is not known at this stage whether the code has mutated into an active exploit for delivery, but it is feared that an automated attack based on MS05-051 will only be a matter of days away (at most).

The most critical security patch, MS05-051, has also caused issues for some users, with their systems effectively becoming unusable following application of the patch. Although Microsoft have now provided information on their site for correct application of the patch, and resolution of the issues which could arise, it is possible that many people will uninstall the patch, or delay application unnecessarily, due to the added administrative burden required to properly configure the systems.

A major spike in traffic on the affected network port appears to have been arrested over the last couple of days, but it is possible that the activity represented probing actions, with the proverbial calm before the storm as the US and Europe pass through the weekend, and a mass exploit due in the very near future.

It is considered probable that an automated worm will appear soon, and will begin mass infection of systems, with the peak of the attacks hitting at the start of the US working week. It has also been disclosed that there are some low threat malware applications which remain functional even in Windows Safe Mode, which is used to effectively remove embedded malware. It is predicted that this sort of capability will only become more common across the various malware vendors and applications.

The vulnerabilities currently being targeted as a result of Microsoft's patch releases are not the only major threat that is facing the Internet over the next couple of months.

The ongoing argument between the Tier 1 ISPs, as treated in last week's column, continues to simmer, public exploit code has been released for a month old Cisco router vulnerability, and a brewing argument between the European Union and ICANN (a US organisation which manages / assigns IP - DNS relationships) over control of DNS could threaten the future operational structure of the Internet.

Essentially, the EU is arguing that the US should not have sole control of the top level of the Internet, and that it should be passed to a more global organisation (such as them). The risk is that if a consensus is not agreed upon at talks in Tunisia, it could see competing top level records established by ICANN and the EU. If it is mandated that EU companies have to register with the EU servers, it could see situations where sites such as telekom.de point to two completely different addresses, depending on which set of address servers you use. While it is more likely that in this situation most companies will just register the same data with both authorities, the problems surface when there is a dispute, or companies are too slow to establish the duplicate records and a competitor or squatter get the records first. Given that there is no compulsion to use any of the existing services, it will be interesting to observe how this change is mandated, and enforced.

The news from last week's column about the English Security contractor who was convicted of 'hacking' a donations website has continued to inflame emotions within the Information Security industry. Daniel Cuthbert was charged under the UK Computer Misuse Act for 'hacking' a website which was accepting donations following the 2004 Tsunami. A number of people have stepped forward to provide character references in an effort to provide at least some balance to the situation and reporting. It has also come out that Daniel is involved with OWASP, an industry group concerned with improving web application security knowledge and implementations, leading the London branch of the organisation, and he will be presenting at the upcoming OWASP conference in the US.

Unfortunately, it appears that Daniel's Information Security career has come to a sudden end as a result of the court case. It also appears that the case has caused a schism between Information Security researchers and law enforcement agencies, quite the opposite result from what was probably desired from the case. Unfortunately it has also caused deep division within the industry as various groups align on the different sides of the argument (that he did / did not do anything wrong), and it is likely that the current arguments will leave at least some lingering effects.

Losing a skilled Information Security worker could be seen as a strange move, given a recent survey conducted by IDC, on behalf of Cisco, of various CIO's across the UK and Europe. The survey has found that the respondents are expecting a shortfall of skilled workers as soon as 2008. In the UK it is estimated that as many as 40,000 positions may be unfillable, and across Europe the figure may be as high as half a million. A Cisco spokesperson indicated that these positions will not be general IT positions, but rather they will be highly specialised positions, such as Wireless technology (802.11, Bluetooth), and security. It has been said for a while now that Australia faces a critical shortage of skilled Information Technology personnel, amongst a greater shortage overall of skilled workers in the workforce. This latest survey indicates that this problem appears to be facing other countries as well.

Perhaps some of these skilled positions will be in protecting mobile gaming devices. Following on from news that the Sony PSP has been affected by malware which makes infected units unbootable, it has been disclosed that the Nintendo DS (a competing hand held gaming system) now has its own malware which also makes the unit unbootable. Known as DSBrick, the malicious software poses as user developed code, and overwrites various sections of memory in order to make the DS unbootable.

Sometimes, the extra staff will not necessarily prevent bad things from happening. The most advanced online banking security model currently in use (the equivalent of a one time pad) has recently come under extra attention from phishers. A Swedish bank was recently targeted with an attack which requested users enter the next several codes from their appropriate pad, providing the phishers with a limited number of attack opportunities. While increased user knowledge would avoid such a blatant attempt, a well designed phish, which claims that the first code was improperly entered, will be more likely to successfully obtain details that can be used to access the accounts of their victims. This is the first attack of this type to be reported on, although it was predicted quite a while ago (by us). The Sûnnet Beskerming online banking security products, and model, provide security that can not be defeated through tricks such as this, and which are immune to all known phishing attacks and predicted attack models.

Finally, a threat which is not related to any Information Security threats, but demonstrates well in a slower time frame how Information Technology systems tend to get infected. The current strain of bird influenza, H5N1, which is causing concern globally for its potential to be a repeat of the 1918 pandemic (actually, much, much worse than 1918 - which was also a bird flu variant), appears to have mutated to be immune to the most widespread pharmaceutical defence against it that exists, Tamiflu (oseltamivir). It has been reported that a Vietnamese girl who was infected with the virus showed no response to the drug when it was administered to her, instead her body developed a much stronger, drug resistant strain.

The current spread of the disease through wild and domesticated bird flocks, and the last effort attempts to control the spread, have a parallel in rapid spreading computer based worm / malware infestations. An initial host is infected intentionally by the malware author (natural virus mutation in the birds), which then seeks out other vulnerable hosts in the nearby environment (same for the birds). Once a certain critical point has been reached, the infection escapes the initial contained environment and starts attacking more remote hosts (same for the birds).

From here, the infection saturates local vulnerable hosts and continues to spread along network connections (migratory paths for birds). As defences are activated, such as network disconnection, firewalls, IPSs, active sysadmin actions, and non-vulnerable hosts, the infection rate slows and eventually subsides to background noise as all vulnerable hosts are exhausted. The same thing is being observed with the bird flu, with continued global spread into Europe despite slash and burn tactics against bird flocks. Countries not yet infected are starting to take action, such as the Netherlands dictating that all domesticated birds must be kept indoors, and others continue to be protected by geography (such as Australia and New Zealand), despite the geographical proximity of confirmed human cases (Indonesia).

If and when the virus mutates and blends with the existing human influenza, it is probable that an extremely virulent influenza that is transmissable from human to human will be formed, and the pandemic will have started.

Who Needs Enemies? - 03 October 2005

Sometimes patch releases don't always go as planned. Following a release by Microsoft last week of patches for Internet Explorer 6, and DirectX 8, it was discovered that the patches were identical to those released in May 2004 (Internet Explorer), and August 2003 (DirectX 8). The 'Release Date' and 'Date Published' for both updates showed a date from last week, as well as Microsoft's Download Notification email which was sent out. At least the patches were for issues that had already been resolved (in the earlier patch releases).

Sometimes it isn't the patches, but the actual software itself which doesn't necessarily work as planned. The launch of a search engine with built in anti-phishing (trust) features encountered a hiccup when it was discovered that an obvious phishing site had been listed as a trustworthy site. The search engine, TrustWatch, is derived from the technology which drives the 'Ask Jeeves' search engines, and provides its evaluation of the trustworthiness of a site, alongside the normal search results. Netcraft, which operates a similar service, also stumbles when it provides the phishing site in question with a risk rating of 'one', which is one step removed from a trusted listing.

Incidents such as this highlight the trouble faced by automated tools which attempt to classify trusted and untrusted sites, and the false sense of security that they can provide to the end users. The major risk is that they will classify a site as legitimate which isn't, and this will lead to users entering sensitive data onto a phisher's site, having trusted the results from the tools. Where the liability lies will surely be resolved by the courts following the first set of major breaches. Unfortunately it also gets the phishers working harder to ensure that their sites match the legitimate sites more closely, which has the result of making it more difficult for the non-technical user to differentiate between the legitimate and illegitimate sites.

Staying with odd behaviour from software, and there are times when the users would almost give anything for a suitable patch to be released. Reports have been circulating that malicious software has begun to surface which attacks the Microsoft Jet Database Engine vulnerability which was initially reported on in the column of 8 August.

The Jet Database Engine is used as a component of Microsoft Access, and the flaw has been known since April this year, with public exploit code circulating since early August. Microsoft have yet to issue official acknowledgment of the issue, and the malware currently circulating apparently opens a backdoor on infected systems, allowing their complete compromise (or rapid assembly into a zombie spam network). It has also been claimed that this vulnerability affects all Windows systems from Windows 95, onwards (previous reporting only identified Windows 2000 and later).

Aside from the issues which appear to have plagued Microsoft in the last week, one of Microsoft's main competitors, Apple, has been in the news over public disagreement about iTunes Music Store pricing.

The week before the rumoured opening of the Australian iTunes Music Store, Apple's iTunes Music Store is beginning to publicly upset some Record companies, with Apple's CEO Steve Jobs recently digging in against efforts to increase the base cost of songs on the US version of the store. Already, the CEO of Warner Music has publicly complained about the price point that Apple has set with the iTMS.

Online forums have lit up with the virtual wailing and gnashing of teeth (appropriate royalties paid, of course), at the perceived greed of the Record companies. Standard complaints and gripes claim that the industry needs to accept new distribution methods as part of their existence, that music sharing existed long before the Internet, and that the music industry should not complain about the services that at least appear to be providing a reasonable (for the consumer) price point for purchasing music in an electronic format. Mixed in with those responses are ongoing claims that the Record companies are behaving like a cartel through their Industry Association, and that they are monopolistic.

Not afraid to weigh in to the argument, the Canadian Recording Industry (through Environics) has released an amazing report (that they sponsored), which claims that Canadians between the ages of 18 and 29 are more likely to shoplift, cheat at school / university and illegally copy music and software. It is suspected that the report was issued in an attempt to link the use of Peer to Peer (P2P) software, and criminal and unethical activities. Although correlation does not imply causation, now that the report is on public record, it suggests that the general populace will only recall the sound bite snippets from the reporting, and not the underlying agenda.

Unfortunately, this is not the only widely reported case involving the horrendous use of statistics to push an agenda in the last couple of weeks.

Further doubts have been cast on the accuracy of the recent Internet Security Threat report from Symantec, when it was discovered that an English town with a population of less than 40,000 people had the second highest number of infected personal computers globally, behind London, and ahead of likely suspects such as Seoul. The report claims that 5% of the total infected systems were located within the town, out of approximately 2 million infected globally.

That means that every person in the town has at least two computers (some even more), and every system is infected.

It is highly possible that the report is an aberration, that it indicates a localised spike in the sample data set, which has then been extrapolated to fit the population size. This is a risk which is faced when conducting experimental work, that applying set rules to a set of data points which are outside normal boundaries will return results which will fail basic logic tests (such as more computers than people and a 100% infection rate in an area that isn't a global high technology centre).

The outcomes from the Symantec report aren't all bad, however. Parallel reporting from the ACE European Group (an Insurance Group which has partnered with Cisco, Deutsche Bank, KPMG and IBM to sponsor a series of reports) suggests that more than 50% of European companies have suffered significant financial losses from Information Technology system failures in the past twelve months. While system downtime due to hardware failure may be the first thought when it comes to a system failure, the research suggested that weak security, electronic crime and malware were significant contributing factors to the financial losses, with a quarter of respondents indicating that electronic crime was responsible for their losses. The survey claimed that even with 'continual investment' in areas such as security and protection, that 'significant financial losses' were still taking place.

In passing news, companies behind the competing formats for the next generation of home media content have been at each other's throats in the last week. The successor to the DVD is going to be one of two proposed formats, the Blu-Ray, and the HD-DVD. With various high-powered companies in the respective camps, such as Sony and Matsushita for Blu-Ray, and Microsoft for HD-DVD, the misinformation has been flying thick and fast from each side about the opposing technology. Some of the key elements in the recent spat included the available space for content, and also the availability of the actual disks for consumer use.