Infosec - AnShLv

(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','//www.google-analytics.com/analytics.js','ga'); ga('create', 'UA-55257416-1', 'auto'); ga('send', 'pageview');

[anshlv]

ShellShock vulnerability: more than Heartbleed

A new Linux/Unix based systems vulnerability has been discovered, it became open to public last week. Today most systems on the Internet are vulnerable including servers, routers, computers, laptops, IP cameras, etc. Anywhere bash command processor is being used. Though the problem exists for last 25 years, it was unknown before.

There are two ways to check if your system is vulnerable.

Run the following using your bash interpreter:

env X="() { :;} ; echo Vulnerable" bash -c "echo ScriptFinished"

To check all recent vulnerabilities you can use this script: https://github.com/hannob/bashcheck

Once the issue is found on your system, you can update your bash version or apply patches, else wait for vendor updates.

By the way, Apple MacBooks are not secured yet.

[anshlv]

Energetical safety or how to change one bit in APC?

Recently I've had a chance to configure the APC's UPS device providing 4200 Watts of backup energy to my server and other equipment.

The story is about Smart UPS 6000 XLI. I was extending it with one more battery pack, consisting of four 18 kilogram batteries. As the manual says, I should program the added the battery pack in UPS configuration for it to act properly and count remaining time well. Considering manual, that was easy. Eventually I discovered that manual does not correspond the software I was connecting to via the serial cable at all. After nearly eight hours of trial and error I discovered I do not have that useful feature neither over the serial console, nor using the web interface of remote management card.

So I called the support of UPS and asked them (I had to do that in Russian, as support belongs to Moscow and does not care I would like to speak Ukrainian, they just have one support center for two countries). Anyway, I asked how do I mention the number of batteries in this device. They told - you just go to UPS tab on web-interface and do it. Strange that manual did not tell a thing about this, but I have already been there and there was no such option - I told.

The support girl got surprised and told I would need to flash the remote control card. She sent me instructions how to and files I need to get flashing done. As I was doing the procedure under Linux, I referred to flashing over ftp.

The software consists of three binary packages and I managed to upload two and flash two thirds of the software. The third part - so called application, failed to come in, no matter how I tried. So I ended up with half-responsible terminal with no more information about UPS and it's status, as well as broken web-interface.

I read on the web, the solution could be to format and reboot the card. I did it, and lost all connection to the card. I thought I killed it.

I wrote email in response about the situation to the girl I talked with, but got no response, so was left on my own.

After a couple hours of thinking, I changed the port speed from recommended 2400 to standard 9600 on the COM port and it came alive.

At last, when the card came alive, I called support once more, and a guy, hardly understanding me (or unwilling to understand), said to complete the flashing I need to swap the order of files I am uploading. My words about the manual sent by girl and the order mentioned there were not heard. - Just change the order, he said. Or try to flash the card over X-Modem, find how at our site (he meant APC). - Oh no, they aren't at the site, I will send you, told he in a minute.

After I received his e-mail I got shocked of the procedure complexity. I just closed the message and started thinking how to flash the old way. I was not physically near the server and this procedure would make me pull the cables and plug them back, simultaneously doing other strange voodoo things. I trusted the logic, that no one would play this way.

Again after searching Internet for one more hour, I discovered some people enter "bin" command before flashing. I guessed I need to transfer ftp client to binary mode beforehand for this to work. When I did the trick, the device got flashed over FTP and using web interface I saw the long struggled option to select number of batteries and many more at the UPS tab.

Does it all need to be so difficult and take full 24 hours of work? Ask APC.

[anshlv]

LinkedIn spams people

Usually, when I wish to add a person whose e-mail I do not know, I cannot do it on LinkedIn because of very prohibitive policy, used by the network.

It may seem, LinkedIn does it's best to protect privacy of their users. But does it in fact?

On Sunday, September 2, I logged into my account and the system proposed me to add many people I might know, who it found in my mailbox, while I did not allow it to enter any of my mailboxes recently.

That means the network stores once received log in data and reuses it on regular bases. Even more interesting - after I chose who do I send invitations to, while being quite surprised how the system behaves, I saw all my numerous invitations to generally unfamiliar people were successfully sent.

That was not the case yet. Next I got a list of nearly 12 people I might want to invite joining LinkedIn (again from my e-mail). I unchecked 11 of them and sent invitation to just one. After receiving confirmation about over 1000 invitations sent, my eyes slightly increased in size.

In fact there was a scroll, which you could even not notice if you use web fast and do not expect such things from well-known services.

To say the truth, LinkedIn is spamming with just no efforts to prevent it. Just doing it's best to promote itself among people I have ever communicated to during my life.

I think I will be receiving complaints during the next month. Will LinkedIn?

[anshlv]

Email is The Identity. Will this change?

In the modern electronic word your mailbox is the identity of you. Whenever you lose passwords, access to services - you retrieve your password, or renew it using the e-mailbox.

Same way, you are not present on the web, until you register a mailbox.

It has been long since e-mail was introduced, and today it is still a key service to identify people.

I analyzed why do we still need e-mail, and decided - it is the most guaranteed way on the web to contact a concrete person. While this is a big question as to how often does person check his/her mailbox, also emails often change so we can not really track them. This way identities often get lost.

The next logical step would be using the sole identification by social networks, as by definition this is your second, digital "you", which usually is more stable and less changeable. Also it is far easier to renew.

The idea is not everyone wants to be public. I suppose, some shadow social networks profiles must be introduced by major social networks. Then every such profile would get a numerical id, using which the person could be still reached, not disclosing any personal data to the sending service. Also the number would have to be centrally-assigned and unchangeable.

This way the network, hosting your personal profile would be responsible for keeping track of you and assuring you will still be reached at the same id for a lifetime.

Again, this is convenient so you won't have to update  your email addresses all over the web on mailbox change and you still can use different mailboxes as a messaging tool. The disadvantage is - when one day you decide to hide from the web and keep your life personal, you will be unable.

[anshlv]

Lancaster university invited future cyber cops for training

Metropolitan Police Central E-crime Unit (PCeU), as well as suppliers HP and KPMG support the training with 30 people selected for a five-day training. Cyber security professionals will teach amateurs about cyber security. Students were selected in the Cyber Security Challenge competition being held since April.

This is a first camp of a kind, and, if successful, these will become regional camps at local universities specializing in computer science and cyber security.

You may read more about the learning program here

[anshlv]

Dubai strenghten information security

Emirates decided to improve their data security, which was said at Dubai Government's Information Security Committee's first meeting. First steps to implement government-level global information security system were taken. This resolution had been issued by Dubai Crown Prince. Dubai suppose, more serious investors will come to United Arab Emirates, while knowing their data and online transactions are highly secure.

[anshlv]

Future of insecurity

You will be missing times, when you had your own files at the laptop and did not worry someone can forbid access to them. Or easily steal them. There were spyware and viruses, but if experienced, you could be sure nothing goes that wrong.

Tomorrow you will make hard use of cloud services, and eventually your life will travel to foreign "clouds" of web servers. Whether business or personal, not you will control your data, but... Your most secure in the world provider - is it Google or anyone else.

Do you remember one told, the World War III will fire when someone pulls the cord out of the socket? No need now. They can just block files and data of all business and personal scopes, then tell - you do this, or will never get your info back.

As you see, any too much centralized system is not good. I suppose Google has already overcome the point of no-return. It has too much finances, powers and monopoly to just electronically rule the world, buy smaller companies and eventually become the one "cloud" for all world's data.

I think we should worry today about our tomorrow and develop worldwide antitrust laws and actions to prevent global centralization. Even this sounds funny, because it is inevitable on the one hand, and on the other... now you think.

[anshlv]

Smartphones and privacy. Howto?

I am looking for my first smartphone. I read some reviews and decided to take HTC One S if it wasn't that much expensive and big.

Meanwhile, being a security person, I understand how much danger is posed by any mobile computing devices, able to communicate not only with Internet, but with Google's headquarters (in case of Android ones). This way you not only allow to spy on your phone contacts, but on your location, phone conversations, SMS messages and camera pictures.

Is there a way to protect yourself? I suppose, now to keep your information near you need a trusted operating system, total Internet connectivity control, even more - a kind of a firewall, scanning all outgoing traffic, sent by your phone. A whole new security industry should be developed to defend your data mobile-wise. Other ways, the monopoly of your mobile OS vendor, cellular operator or social network will let you no freedom to be private at all. What do you think on that topic? Any ideas?

[anshlv]

Why do we create websites the way we do?

Recently I had been developing HTML5 and CSS3 markup along with JQuery. May I be not the only person who thought "why?". You also might notice I did not have neither time nor desire to blog during that period.

There are many companies, developing their brand new sites. It includes the redesign, total re-creation and much more. I suppose, don't get me wrong, but the most inefficient task in the modern web is site creation.

We usually spend time and money just to mess with nice graphics and a bunch of scripts or CMSes, usually with no idea about what does it bring.

The technology often takes over the aim. Aim is to simplify access to information. That is why we use Google so much, and that is why, if we could, we would never visit a single site.

We aren't searching for beauty, nor having time for it if accidentally found in this mega fast world. We just get surprised and annoyed with - oh, one more site. We do not notice - oh, that is admiring, how it simplified my life.

That is why the more often I browse or develop the web, the more often I wish to change this. I mean simple things are truly genial. Just remember Linux.

I also feel the beauty of those sites, which allow me to guess where the most essential parts of the site are in a few seconds. And this is what I am searching for. The most exciting moment comes when I find the information I was looking for in just a few clicks.

Maybe we have come up to the moment when content really over-weights the form, usability overcomes complexity and speed takes over exploration?

I am working at the project, which would revolutionize the way we work on web and it is http://lackedit.com

I also think about the project to reinvent site building and it yet has no url.

Maybe urls are also obsolete? Welcome to Web 3.0.

[anshlv]

Facebook will never be safe to use

Jacob Appelbaum, hacker, former Wikileaks volunteer recently told not to register on Facebook if you do not wish surveillance organized on you. He admitted, you will give out sensitive information even without your consent - if you have even a couple of friends who may tag you on pictures.

To be even more precise, even if you do NOT register, you might be tagged - but that is just another part of story.

Also Jacob says, Facebook is the greatest database of Jews, leftists, right wing people and anyone else in the world, who may be targeted one day after the governmental change.

There still is one way to use it through IP substitution tools like TOR and inserting false data, having false friends, making information other ways useless. But is this the reason millions of people use it so much?

[anshlv]

QR-code mania will get you hacked

Today we face popularity of QR-codes. Most tech-savvy people already actively use them to transfer encoded digital information into their devices, to follow links and to  input data into their devices with no manual typing.

Some inventive "hackers" already started using this technique by sticking false QR-codes over real ones. So in case you use code-recognition client, which is automatically following links, and your Android phone does not ask you before installing apps other than those from Android market, you are in trouble. Such QR-codes might drive you to the download of a false operating system update, being a virus.

So beware of too much automation in your QR-reading software.

[anshlv]

Today is the end of the Internet in Bielorus

This beautiful sunny day in Bielorus tends to be the final step about cutting off the Internet by the country's borders. Now most worldwide resources, host providers and everyone else in the world, ever benefiting from *.by zone traffic will suffer clients loss. The President of Bileorus, Aleksandr Lukashenko introduced a law, penalizing everyone, who will access foreign servers for almost $100. Today this law enters into force.

On the other hand, in Ukraine, which is neighboring Bielorus people expect the same situation, as both countries present strong dictating regimes. Just Lukashenko's one is more perfected. Seems, Europe will allow this to happen, seemingly not realizing the new USSR is going to be established.

Then, maybe real information security starts when there's more security, then information?

[anshlv]

Skype mystery or are you under control?

I have heard many "safe" and "dangerous" stories about Skype. Being confused as to what I should believe in, I opened Google and understood two things right immediately. These are concerns about Skype:

1) Is your VoIP data secure with it;

2) Is all other data you own, secure, when Skype is installed at your device.

Considering the first, company is hardly trying to convince, that it is. Looking for the latter was a little trickier.

Recently a group of researchers at NYU Polytechnic Institute found out the fact - when you call a person on Skype, you can discover his/her IP address, even if the person doesn't "pick the headset up". There's also a possibility to define which torrents are active at the target PC, and ability to track how one moves from point to point without any permission.

Up to now, providing your updated the previous Mac OS X exploited Skype, which allowed to remotely control your PC and network altogether, there are no more concerns about Skype as for now.

[anshlv]

Your habits will identify you

Still one more thing left unsolved in identification aspect of the Web. How do you prove, the person, sitting in front of the monitor is that very same she claims to be? I personally thought about it before, and today Defence Advanced Researh Projects Agency (DARPA) decided to solve this finally. They would identify a "digital signature" or "digital fingerprint" based on your habits of mouse usage or the way person normally types.

Now algorithms are going to be developed with the help of scientists, who are invited to send their proposals.

Active Authentication industry day on Nov. 18 is to encourage industry to submit authentication proposals. Proposed research should investigate innovative approaches that enable revolutionary advances in science, software, or systems in the areas related to determining the identity of the individual at the keyboard.

infosecurity-magazine.com

Some years ahead, we either will no longer be anonymous on the Internet, or will use anonymity tools for impersonation of our activity or to steal someone's habits, recorded in the file. Probably viruses will be stealing our habits. Lots of interesting stuff still expects us in the eternal battle between the key and the lock.

[anshlv]

Madonna's fault or leaky promotion techniques

Have recently read the new video of Madonna gone for web before the final release. And this was a demo-version, which raised a great tsunami of discussing on Twitter and other social places of the web.

I came up to the conclusion, leakage promotion techniques is a great way to reload the interest for some artist or public person on purpose. Especially when it is far too low.

Another leaks from Sweden remind us not to use one password at every site. They again do. But we continue to ignore.

Details of 210,000 Swedes - politicians and media figures, have been exposed to the Internet, which affected one person among 50 unaffected. That is called the greatest security breach in history of Sweden.

Once told, there's no personal life today any more, came true and will never roll back again.

But that is the good - world needs InfoSec people each day more.

[anshlv]

Find out what waits for you at the corner on the web

Saw cheap IPhone 5 today at the electronics market. Fashion rules, no doubt, and everyone wants the toy. Even though the 5-th even doesn't exist yet. Strange feeling to witness the ghost.

I expanded my network of InfoSec specialists, analysts and geeks on Twitter. And got hinted to look at owasp.org project. I usually have numerous tabs open in Firefox, never timely reading them - so they grow. Now I have a couple more, promising myself to read them asap. We talked about ghosts, right? They say companies are divided into those which do know their web applications code is insecure and those which don't.

This ghost chasing is rated well in OWASP's top 10 rating of threats your company (and probably you) face during web information exchange.

Here is the link to the 2010 document. It appears, not much changes over time, so they don't update the rating annually. Still it is very current, being reviewed by some top companies from the industry recently. 

http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202010.pdf

There's much to think about.

[anshlv]

Facebook reveals hidden security mystery

Facebook has revealed a security system called FIS (Facebook Immunity System). FIS controls every read-write action of each user on the social network. This defends 99% of Facebookers from spam, as stated by Facebook itself. The defense system happens to be the biggest in the world, equipped with 30 supervisors, enabled to learn and take actions on noticing suspicious behavior patterns.

The system, as it seems to me, is still far from the artificial intelligence. But is already able to combat massive viral script attacks within the network by blocking messages based on keywords once found and identified in spam chat messages.

Still unknown techniques make the system vulnerable. Social bots tend to fool the system, even adding thousands of friends and harvesting sensitive data like e-mail addresses. Due to peaking number of friend rejections spam bots receive, Facebook predicts improving FIS based on higher, than usual rejections amount.

I personally recently found out Facebook controls the speed of friends addition, if you add them too fast - you get considered to be a bot, even if you just re-add known people to the newly created account. If some people reject you, you already get blocked for a couple days, or a week without even a guess, who did it.

Still much job to do, but unless real artificial intelligence gets invented, we are going to face constant rules creating and breaking in this highly socialized world.