Tales from Room 641A

Summation of Decon 18:   Awesome.

Pros:  10,000+ people, including some of the brightest minds in security.  Terrific Contests, great Hacker talks,  and just the right amount of party.

Major thanks to all the organizers, vendors, speakers and most of all the Goons.  Ever try herding 10,000 cats?  The goons did it, and did it well.

Cons:   Major long lines for friday/saturday talks (Blame Dan Kaminski?) ,  Power being out in the hotel room for about 15 hours ( I swear we left the Mainframe at home….),  and some blistering heat the two times I dare venture outside the safety of the compound.

Top personal moment from the con:  Social-engineering contest, hands down.

Pac-man returns?

A kids tv show revolving around pacman? So, he’s a slacker, who eats some magic pills,  gets really hungry, and ends up running around trying to eat ghosts?

Some games should not be tv shows..

EFF launches Firefox plugin to use ssl by default

Check it out. Install it for your friends, family and loved ones, because most likely, they won’t ever hear about it.

 Only you can prevent unencrypted transmission of private data.

Welcome again to another look at the ATT mishap.  Part two of our story takes us deep into the realm of the deadly SIM…

In summation, researchers have shown that some of the major telecommunications carriers make it possible to determine your IMSI number from you ICCID number.   What once was not a big deal, now becomes more of a problem.

The IMSI ( International Mobile Subscriber Identity) can theoretically give a malicious attacker the ability to track, intercept (with some work/tinkering/and some tower action) and perform other not nice nastiness.

Chris Paget posted quite a nice blog on it.

From this article out of eweek

—“There is such a thing as security through obscurity,” Hilwa added, “and it can be quite effective in certain settings. If I wanted to have the least attractive stack for virus and malware attacks, I would use the most obscure stack I can find, potentially including custom-developed components.”—-

Al Hilwa’s IDC Profile  which sadly seems to lack any security experience.  His Linked-IN resume also doesn’t show an ounce of security background.   

I guess we must excuse Mr Hilwa for making such an obviously flawed and universally stupid statement.  But, to be thorough, let’s rip it apart piece by piece:

1. “There is such a thing as security through obscurity,”

       I guess I can’t argue with that…  there is. It is horrible and almost worthless security, but it’s security. An example of security through obscurity would be having the company phone directory unpublished. It provides a minimal level of security, but anyone who wants to determine the CEO’s direct line can do so with a little rigor and some social skills.  If there is something to gain by hacking a target,  there will be hackers attempting to break it.

2. and it can be quite effective in certain settings.

Please Mr. Hilwa, make a list of those quite effective settings in regards to computing…   It will be a rather short list. 

3.If I wanted to have the least attractive stack for virus and malware attacks, I would use the most obscure stack I can find, potentially including custom-developed components

Anyone who has ever worked a microsoft product knows, they already have some of the least “attractive” stacks and customizations to work with. Yet they are a prime target for security vulnerabilities, hacks, and intrusions. Why?  Because there is much to be gained by hacking a Microsoft system. Banks, governments, private business, all the way down to your local churches most likely have some version of MS running somewhere.  The effort versus reward basis is quite nice in the windows world, as one vulnerability can be applied to many lucrative systems.

People will attempt to counter with the concept that “Apple has a big market share, why are they not affected as much?”  Apple is not hosting a large chunk of the Worlds information. Criminal hacking groups don’t want to target Jimbo Jones with his slick hair and iphone. He is small change compared to a SSN database in virgina.

Mr. Hilwa, you have a terrific set of experience in the computer world. I would just ask that you get a little more education in the security side before making such statements.

China’s Root Certificate Authority

For such a short article, this creates some major questions.

Let’s begin..

1. This is the general information from the CNNIC:

China Internet Network Information Center (CNNIC), the state network information center of China, was founded as a non-profit organization on Jun. 3rd 1997.

CNNIC takes orders from the Ministry of Information Industry (MII) to conduct daily business, while it was administratively operated by Chinese Academy of Sciences (CAS). Computer Network Information Center of Chinese Academy of Sciences takes the responsibility of running and administrating CNNIC. CNNIC Steering Committee, a working group composed of well-known experts and commercial representatives in domestic Internet community supervises and evaluates the structure, operation and administration of CNNIC.
CNNIC INFO

So where the original article states: “CNNIC is said to be controlled by the Chinese government” is correct.

So, with the Chinese Government now controlling a root certificate, what is to stop them from performing man in the middle attacks?

BUZZZ- Stop right here and read Gerv Responds

If the hijacking is done “on a nationwide scale”, then someone should be able
to produce some actual evidence of it. Download the bad cert, email us a copy,
and we will act.

How would you like it if I locked you up or fined you because I thought you
were a criminal and didn’t want to “wait until the foreseeable crime happens”?
CNNIC is innocent until proven guilty – an important cornerstone of justice. If
their abuses are as widespread as you say, then producing evidence to prove
them guilty should not be difficult.

Gerv

A very valid point by Gerv, there are more and more of us…. security minded individuals out there. Surely if a Government was going to mIm, one of us would notice it. Unless of course the government has control of the entire countrywide network and can do client-side /server-side ssl for every connection it wants to watch.

Idea works like this:

Client wants to access https:\\bobmarket.cn. They fire up their mozilla browser and tap it in.
That ssl hand shake goes out across the network until it hits the router or router 1 hop outside of bobmarket.cn’s POP. At that location, a piece of network gear(possibly a load balancer, or just an SSL accelerator box) initiates the client-side SSL with a certificate signed by the CNNIC. Encrypted Tunnel to the SSL Accelerator Established, and the client thinks the tunnel is to https:\\bobmarket.cn.

Now comes the fun part, the SSL accelerator then forwards the unencrypted traffic to the real front-end of bobmarket.cn, and initiated the SSL handshake there, using bob’s real certificate. Traffic flows, everyone is happy, and the information is decrypted for anyone to read.

ISSUES with that scenario- What is bob returns a packet along a different route, not through the same SSL accelerator that has the encrypted tunnel. That packet would hit the client and be dropped, as the client doesn’t have a session with bob. Perhaps stateful SSL Accelorators on all the connections into bob?

Please point out other issues as you see them, I’m not the end all be all of security.

School admin resigned over SETI Installs

So the School district has police looking for potential criminal charges? As I understand, his position was: Information technology director. Therefore, can he not authorize any and all software for district installs?

Another article states that he “had permission from a previous administrator”. If that is true, it just goes to show how important documentation of authorization is.

Was the installation of SETI software a on an entire district worth of computers wrong? Possibly
Did it cause the district to lose money or have to replace systems at a faster rate? Possibly
Is it worth a resignation? Not in my mind, perhaps a slap on the wrist and an uninstall of all the installs, but resignation.. a little much eh?

Oh so right...

If only the TSA read XKCD….

It should come as no surprise that job websites are a target for criminal elements. Stop and consider what information most applications require….

name, address, phone, social security number….
and now think, what does a credit card application require..

Do’h!

Job Board Security Breach

Latvia.. I knew it!

Latvian ISP removed from the internet.
It will be interesting to look at the spam numbers before and after this takedown.