Security – Page 10 – More Zonkyness

Does Google’s Glass Herald The End Of Civilisation?

Computing, General, Security No Responses »

May 192013

Executive summary: No.

According to some, the introduction of Google’s latest product – the Glass(es) – will undoubtedly herald the end of civilisation as the we know it and the survivors will be skittering from bunker to bunker in a forlorn hope of evading surveillance. Actually the biggest threat Google’s Glass(es) have to the world, is the threat to proper grammar – they’re glasses!

The strange thing about the lists of problems encountered with Google’s Glass(es) is that they are “problems” that are already here. Google has done something nifty with their product, which is basically to integrate possibilities into something a non-geek can use. And it is not as if it is particularly revolutionary – people have been looking at augmented reality on smartphones for years and thinking that it was pretty cool, but wouldn’t it be better if you didn’t have to hold up your smartphone all the time?

The big problem is the threat of pervasive surveillance, and threats that come about as a result of that pervasive surveillance. If Google were never to have invented these things, we would still have a problem with pervasive surveillance. As other have pointed out, the use of video (and still) recording on smartphones is already bring in an age of pervasive surveillance; or at least pervasive surveillance under the control of individuals as we already have pervasive surveillance by corporations and government.

It is true that there are negative aspects to pervasive surveillance, but it is also true that there are positive aspects too. Street crime becomes a far riskier proposition if everyone around can just say “Ok. Start recording video.”. People getting up to foolish activities being “outed” on Youtube? The more it happens, the less the pain.

And of course make laws to punish the publication of privacy invading video but not the recording of it; with a proper public interest imminity. That is what the public should be interested in, not what it wants to be interested in.

There are those who say that publication of embarrassing activities onto social media sites may make it harder for people to get employment. The fault here is not what is published to social media sites nor people who take part in such activities, but with the employers who insist on having employees so squeaky clean. If you never employ people who have danced naked on top of a table, you’ll end up with boring employees.

And I’ll bet that there is a high incidence of naked table-top dancing in the past of anyone whose thinking is inventive, creative, and out-of-the-box. Or in other words, employers should be going out of their way to hunt down and employ the naked table-top dancers (No I probably haven’t).

There are those who say that it will somehow increase bullying. It is true that this will be an extra tool in the arsenal of bullies, but in can also be an extra tool in the arsenal of those targeted by bullies. To stop what happened to Amanda Todd (and others), we need to stop bullying whether assisted by technology or the old-fashioned kind.

And of course we have the argument that Google is powerful enough already, and Glass(es) will make that worse. Well, first of all Google Glass(es) won’t be the only product of this kind out there. And if Google is too powerful, it is time to chop them down to size rather than blocking this product.

At least the hysterical reaction of some businesses is giving me a new retirement fund possibility. When I eventually get around to getting some, mine will have prescription lenses in, and any business that wants to ban me will get sued for discrimination against the “disabled”.

We need to be careful of condemning a technology for the poor behaviour of people, when it is the poor behaviour that is at fault.

Is China The Bad Boy In Cyber Warfare?

Computing, Security No Responses »

May 182013

The strange thing about being involved in information security is the phenomena of cyber warfare.

After all, what does tinkering with computers have to do with real war? Well it depends what all that tinkering leads to, and we simply do not know what would happen in a real war. We are in the beginning of the era when aggressive hacking supports war.

But probably the overwhelming majority of activities labelled as cyber warfare are in fact espionage, or a grey area in between. Any kind of hacking that leads to information disclosure, is espionage rather than warfare. More aggressive hacking – such as writing malware to spin centrifuges into destruction – falls into the grey area between espionage and warfare; it’s too aggressive to be labelled espionage, but isn’t part of a legal war (and yes there is such a thing). In terms of legality, it could well be that such acts are illegal acts of war, but morally justified.

And why is China always the bad actor here? Practically every hacking conference video dealing with cyber warfare drops big hints about the activities of China with little in the way of evidence. There is some evidence that China may be involved in cyber espionage, but as for cyber warfare itself, there is far more evidence for the involvement of the US, Israel, and even the UK; although the rumoured replacement of an Al-Qaeda recipe for a pipe bomb with one for cupcakes doesn’t seem like an act of war, but perhaps an exhibit of the English sense of humour.

Part of the problem is that anyone who reads their firewall logs will find a huge number of attacks coming from Chinese address space. As an example, a quick inspection of the addresses blocked on one of my servers for attempted ssh brute force attacks gives the following table :-

Count	Country Code	Country
255	CN	China
51	US	United States …
29	KR	Korea (South)
19	BR	Brazil
17	DE	Germany
15	IN	India
13	RU	Russia
13	GB	Great Britain
13	FR	France
11	ID	Indonesia

This is not intended to be an accurate reflection of anything other than the number of infected machines trying to brute force accounts on my server.

The high presence of China is an indication of the number of malware infections within China, and the large population of the Chinese. It doesn’t actually say anything about where those attacks originate. Every hacker with enough sense to tie up their shoe laces will be pivoting through privacy proxies, and using armies of infected hosts to send out their attacks. These infected hosts are the ones whose addresses show up in your logs.

Assuming that because these addresses are Chinese means that the Chinese state is behind attacks is faulty logic. There is no reason why the Chinese state hackers (if they exist … although it is almost certain they do) would use Chinese addresses to attack from; they are more likely to be using addresses from the US, Europe, South America, etc. If anything, attacks coming from Chinese addresses indicate :-

Private sector hacking (which is the majority)
Attacks from state groups other than China.

It may well be that China is engaged in industrial scale cyber espionage; it may also be that what people assume are Chinese attacks are in fact other states. After all cyber espionage is probably one of the cheapest ways to get involved; within the means of even the smallest and poorest states.

Web Browser Security: Disabling Java And Having Certain Applications Still Run

Computing, Security No Responses »

May 122013

The immediate reaction amongst security professionals to hearing about Java security exploits is to ask: “Haven’t you disabled Java in the browser yet?”. Disabling Java in the browser is both sensible, and a touch naive.

Browsing the big bad Internet with Java enabled is sort of like wandering around a major tourist attraction with an overly stuffed wallet half-poking out of your back pocket. An invitation for the less than moral to try their luck.

So disabling the use of Java within a web browser seems like a sensible suggestion, and is almost always the right thing to do in a domestic situation.

But in a corporate environment, there is almost certainly some “application” in use that requires Java (or even worse, IE6). And as soon as it is made plain that disabling Java will (or might) prevent corporate applications from working the reaction is to reject the measure to disable Java. Which is perfectly understandable – the cost to an organisation of a certain loss of access to a corporate application may very well be greater that the potential loss due to an unknown threat.

Or perhaps the cost of the former can be measured; whereas the cost of the later cannot.

However this overlooks a relatively simple solution to the problem :-

Use one browser to run corporate applications. This can be as simple as a voluntary measure, or be made compulsory through a variety of controls. It could even go as far as to implement icons to access web-based applications as if they were desktop applications, using a browser deliberately configured to make general web browsing impossible or at least painful.
Use a separate browser to access the Internet. This can be configured differently to prevent the use of dangerous plugins, and indeed can be updated without performing the whole bank of testing needed to confirm compatibility with corporate applications.

We have grown too used to assuming that a computer needs only a single web browser, and that all “applications” accessed through the web, should be accessed through that single web browser. Ignoring the fact that there are different requirements for browsing the web in general, and making use of corporate applications.

There are organisations where access to the Internet is banned because the risk to the organisation is too great. Other organisations reduce the risk by the use of the “air gap” where separate computers are used – one to access corporate applications, and the other to access the Internet.

That is going a little bit too far for most organisations, but that does not mean that increasing the “gap” between Internet access and corporate applications is not a sensible move. And using separate web browsers is the first step along the road of increasing that gap.

Datashur iStorage Encrypted USB Stick

Computing, Security No Responses »

May 012013

Sigh. Yet another company under the foolish impression that you have to stick an “i” in front of something to make it cool. Which is a bit of a shame really, because this is sort of cool :-

What it is, is an encrypted USB memory stick but unlike most others, this one does not rely on software. You enter the appropriate PIN code on the built in pad, and the storage is unlocked. With everything built into the stick there are a number of advantages :-

It’s a lot simpler. There’s no special software to run to decrypt and encrypt a special file on the memory stick.
Because it’s simpler, it’s harder to make mistakes – there’s no chance of accidentally writing unencrypted data to the stick – don’t laugh, it happens!
Also because it’s not based around a software package, there’s no platform limitations – it’ll work fine with all the odd platforms you can find out there – Linux, Android devices, PS3s, old Unix workstations (if you can find a USB hole to plug it into), etc.

However it’s not perfect :-

There’s concern about how long the keypad will remain reliable for. It should be more than reliable enough, as normal keyboards are reliable for millions of key strokes, and this keypad may well be more reliable (it’s simpler).
Because the PIN is only effective whilst the memory stick is “mounted”, it may require a lot of PIN entries when used in certain ways – such as a bootable device.
Entering the PIN whilst the memory stick is attached may be tricky; it might be better used on an extension lead. Although it’s possible to enter the PIN whilst disconnected, this doesn’t seem natural.
Given the environment that most USB sticks live in (i.e. pockets or handbags), there is a concern that moisture, dust, or fluff could work itself into the casing and interfere with the workings. However the case that fits over the keyboard seems to fit quite well including a rubber seal that should help.

One thing that came as a surprise when I first got it was that it has a re-chargeable battery which seems a touch odd until you realise that some operations can only take place when this stick is not connected. This includes changing the default PIN code, and of course this numbskull took an age to realise that you cannot set the PIN code when it is connected to the computer!

Once that was sorted out, it took very little longer to have a properly working USB stick. It works very much the same as any other USB stick except that when it becomes “unmounted” (I use this under Linux) it refuses to act as a USB memory stick until the PIN is re-entered.

Physically it is on the larger size of what is sensibly carried around in the pocket, but obviously could not be much smaller without making the keypad smaller than it is. Whilst usable, any smaller and the current keypad would become very awkward to use for those with larger hands (such as me).

Long term robustness will have to wait until it has been in my pocket for more than a week. However so far, the following observations have occurred :-

The paintwork of the external casing (the cover for the stick itself) may not be especially robust as a few scratches have already appeared.
The wire loop for attaching to a keyring feels a little flimsy, but perhaps that is because the expectation is for a key ring rather than a loop of wire.
The mechanism for unscrewing the wire is a little fiddly.

Media Panics Over Spamhaus DDoS Attack

Computing, Security No Responses »

Mar 282013

This article is short on references because I haven’t gotten around to filling them in … they will come

The fuss in the mainstream media about the distributed denial of service (DDoS for short) attack against Spamhaus goes to show that journalists need to buy more drinks for geeks, and the right geeks. It is nowhere near as bad as described, although the DDoS attack was real enough and definitely caused “damage” :-

This article is not intended to be totally technically accurate in every detail; it is intended to describe the incident in enough detail and with enough accuracy that it can be understood without übergeek status.

So What Happened?

Spamhaus are experiencing on ongoing distributed denial of service attack that started on the 20th March, and is ongoing. The initial attack very quickly overwhelmed their 10Gbps (that’s about 1,000 times faster than your Internet connection) link to the Internet. Whilst this disrupted the Spamhaus web site, and various back office services, the main service that Spamhaus provides kept running (as it is distributed).

The very clued up geeks at Spamhaus who have had plenty of experience of being under attack, very quickly contacted CloudFlare which started hosting their web sites and other back office services at numerous data centres around the globe. Their services rapidly started returning to life – it isn’t the sort of thing that can be done instantly, and probably took a lot of late nights.

However the attacks escalated and reached levels of up to at least 300Gbps (that’s about 30,000 times faster than your Internet connection) or about 13Gbps of traffic for each of CloudFlare’s 23 data centres. That’s a lot and could be responsible for Internet slowdowns …

The Internet Is Slow. Is It The DDoS?

Well perhaps. We all have a very understandable tendency to blame known events for problems we’re having. Is the Internet slow? It must be that DDoS . But it is not necessarily so.

And if all the Internet was slow for you, it is quite possible that you were unknowingly taking part in the attack! Because the attack relied on infected PCs together with other stuff described below.

It is also possible that some parts of the Internet were overwhelmed by the DDoS. Reports have indicated that Internet services plugged in alongside the CloudFlare data centres (or in them) were suffering somewhat because of the extraordinary levels of traffic. However, this is the Internet and there is always lots of stuff going on that may cause slower performance than normal in various corners of the ‘net.

Was This The Biggest DDoS Attack?

Possibly. The figure of 300Gbps (and it was probably larger than that – the 300Gbps figure was through one Tier-1 ISP) probably qualifies as the largest known public DDoS.

However DDoS attacks are not always made public; there could well have been larger attacks that were not made public.

Various responses have indicated that the attack was not as serious as described by others :-

It may be that these commentators are mistaken to the extent that they didn’t see a problem; it may be that European and Asian networks were more prone to a slow-down than elsewhere.

What Is A Distributed Denial Of Service Attack?

If you were an attacker, you could try sending network traffic as fast as your PC could handle to the target of your attack. However the amount of traffic you could send would be very limited – you can’t send more than the speed of your Internet connection. Say 10Mbps … a lot less than most large services use for their own Internet connections.

To make an attack more effective, you will want to have lots of people send traffic as quick as they can. And the easy way to do that is to infect PCs with some sort of malware, and use your control of those infected PCs to send out that denial of service traffic. At which point it becomes a distributed denial of service attack because the attack traffic is distributed around the Internet.

And if you can find some way of amplifying your attack traffic so that say 10Mbps of traffic becomes 1Gbps of traffic, you make your attack much more effective.

So How Was This Done?

The details of what went on become pretty hairy very quickly, but very simply :-

The attacker takes control of a large number of infected PCs to make his or her “robot army” to send out network traffic under their control.
The attacker instructs their robot army to send out DNS requests as quickly as possible with the source address forged as the victim’s address.
The negligent ISP allows those packets out by not applying source filtering.
The network traffic reaches any number of misconfigured DNS servers that answer with a larger reply sent to the victim’s address.

DNS?

This is short for the domain name system and is a service that turns names into numbers (amongst other things). You type in a name such as www.google.com and the DNS server your PC is configured to talk to turns that name into an Internet address such as 203.0.113.63 or possibly 2001:db8:0:1234:0:5678:9:12. Your PC then makes a network connection to that numeric address in the background, and fetches a web page, a music stream or some other content you want.

Without the DNS we would all have to rely on numeric addresses to make connections – a lot tougher!

There’s another factor here as that DNS is an amplifying service – you ask for a name such as www.google.com, and the answer is a whole lot longer than just the numeric address you “need” as it can (and often does) contain a number of network addresses together with associated information :-

% dig www.google.com  

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:
;www.google.com.			IN	A

;; ANSWER SECTION:
www.google.com.		61	IN	A	74.125.138.104
www.google.com.		61	IN	A	74.125.138.106
www.google.com.		61	IN	A	74.125.138.99
www.google.com.		61	IN	A	74.125.138.147
www.google.com.		61	IN	A	74.125.138.105
www.google.com.		61	IN	A	74.125.138.103

;; AUTHORITY SECTION:
google.com.		126160	IN	NS	ns3.google.com.
google.com.		126160	IN	NS	ns2.google.com.
google.com.		126160	IN	NS	ns4.google.com.
google.com.		126160	IN	NS	ns1.google.com.

;; ADDITIONAL SECTION:
ns1.google.com.		126160	IN	A	216.239.32.10
ns2.google.com.		126160	IN	A	216.239.34.10
ns3.google.com.		126160	IN	A	216.239.36.10
ns4.google.com.		126160	IN	A	216.239.38.10

;; Query time: 1 msec
;; SERVER: 10.0.0.26#53(10.0.0.26)
;; WHEN: Sat Mar 30 09:52:59 2013
;; MSG SIZE  rcvd: 264

If you are talking to a misconfigured DNS server, it could answer even when it should not. Normally DNS servers are configured to answer just for those they are intended to provide answers to – your ISP’s DNS servers will answer your questions, and not mine. However if they are misconfigured, they will answer any question and will function as a DDoS amplifier.

This does not include public DNS servers such as OpenDNS, or Google’s public DNS servers – they are specially configured to avoid acting as a DDoS amplifier – probably by imposing a rate limit to stop answering if you ask too many questions.

Source Filtering?

When you click on a link in your web browser, your browser sends out a network packet containing the request (“GET /webpage”), and that network packet contains the destination of the web server – so your request reaches it, and your own address – so the web server knows where to send the answer! Your own address (in these circumstances) is known as the source address.

With appropriate software, you can forge your source address so that replies to your request go back to a different place. Without that only the very simplest DDoS attacks would work.

Of course, it has been best practice to block forged source addresses since well, not long after the beginning of the Internet. This is known as source filtering. An Internet router is capable of deciding that packets coming in from wire A should not have the address assigned to wire B, so should be dropped on the floor.

An Internet router that doesn’t do that is poorly configured.

So How Can This Be Stopped?

The answer is that we have known how to stop this sort of attack for at least a decade. And indeed the best Internet citizens have done so for years.

The trouble lies with those on the Internet who are not necessarily the best Internet citizens. Of the big three remedies, two are probably being neglected because managers of ISPs do not see the business benefits of applying those remedies. And there isn’t a business benefit, but a social responsibility.

The three remedies are :-

The average Internet user needs to take action to prevent their PC from getting infected. Get anti-virus protection, and an Internet firewall. If the PC acts weird, get it looked at. And if the Mac acts weird, get it looked at too (yes they do get infected).
ISPs should apply BCP38 (which dates back to 2000) which specifies source filtering.
ISPs running DNS servers should ensure that their DNS servers are properly configured to only answer queries for legitimate clients.

And if you happen to know a senior manager at an ISP, ask them about BCP38 and if they’re doing it – source filtering is probably the most important action here.

But Who Is Responsible?

It is easy to get distracted by the problems caused by those leaving poorly configured router, and insecure PC lying around on the Internet. Whilst their owners are responsible for effectively leaving tools around that attackers can use (and all too often do use), they are not directly responsible for the attack.

The attacker is.

But who were they?

The fairly credible rumours are that the attackers were either Cyberbunker or Stophaus.com, as part of a campaign against the actions of Spamhaus. Various criminals behind the flood of spam targeting your mailbox with all sorts of rubbish have long complained about the actions of Spamhaus, as they try and prevent spam arriving. And Cyberbunker is an ISP dedicated to providing hosting to services that may get shut down elsewhere – they deal with anyone except paedophiles and terrorists, which leaves a whole world of swamp dwellers that you would really rather not know about. And spammers.

Who Are Spamhaus?

Spamhaus are subject to a great deal of black propoganda – including accusations of blackmail, extortion, censorship, and probably kicking cats too. The reason? They help identify spammers, so that ISPs can choose to block spam.

Spammers are somewhat irritated by this – their business model relies on polluting your mailbox so that the 1% (or so) of people who do respond to spam is a large enough number that they can carry on making money. And they get irritated very quickly if someone tries to interfere with their “right” to use your inbox to make money.

Mail server operators have long been blocking spammers using a whole variety of methods, and some of the best collaborated on producing lists of addresses of spammers that others could use. These evolved into DNS based RBLs, and one of the most respected groups of volunteers became known as Spamhaus.

You may be thinking that you still get plenty of spam, so they cannot be doing too great a job. But :-

You may be with an ISP that chooses not to use Spamhaus.
You don’t see the spam that gets blocked. Even if you see dozens of spam messages a day, you may be seeing only 5% of the spam that was sent your way.

It is telling that amongst those in the know, those who deal with spam and Internet abuse in general, there is practically nobody who thinks of Spamhaus as anything other than the good guys.

Older Entries Newer Entries