Friday, December 19

Patch Tuesday Catylst for 0-Day Wednesday

As well intentioned as Microsoft is regarding getting security patches out to the public, they've created a vulnerability for people by setting a date for the release of security fixes each month and on a monthly basis. By releasing previously unknown (by Microsoft) vulnerabilities the day after the fixes are released they get maximum exposure (about 30 days or so) unless MS provides an out-of-band patch.

Is this recent behavior enough to get Microsoft to abolish their practices of once a month patch releases? I think it should be - as patches should be released as soon as possible for each fix. But I also understand it costs money to test and out releases.

Plus this still doesn't even touch the issue of the unannounced vulnerabilities, which in my opinion is a much greater risk than the ones we know about.

Monday, December 15

Early gifts - Security related products updated before the holiday

Not quite Christmas yet, but here are a few links of early presents to look into over the holidays:

  • Burp Suite V1.2 - IMO the best security proxy / attack tool, and now with a paid-for license you get semi-automatic scanning!
  • OSX 10.5.6 - not really a security tool - but some much sought-after fixes to some OSX problems.
  • VirtualBox 2.1 - we all like useful things we don't have to pay for.
  • Microsoft OOB Patch for Internet Explorer OLEDB Issue - Ok, maybe this isn't like a present, but we were all waiting for it to arrive still.
  • NetworkMiner - Cool utility for extracting stuff from pcap files.
  • OWASP V3 - The third edition of the community sourced effort to standardize application security testing.

Happy Holidays!

0-day Wordpad Vulnerability

As described by Microsoft here, there is a new 0-day vulnerability which is being used in targeted attacks. It also would appear difficult for traditional AV products to detect the difference between legitimate text documents and ones which may contain the exploit.

Thursday, December 11

Google Publishes Browser Security Handbook

In addition to other excellent google security products like ratproxy, they have released a handbook to browser security functionality, including details on support across all of the common platforms.

After reading through this material, it is an essential resource to understanding common security issues related to the way browsers handle the security of a site. It also appears that its being expanded to include information on future browsers as they are released.

It even includes sample code to describe the concepts which are discussed! Thank you Google for another great resource.

Wednesday, December 10

0-Day IE Vulnerability

Another example of a 0-day vulnerability has been described by SANS. This one on a fully-patched version of IE7 which according to recent browser stats 47% of you are using.

As I've written about before, there appears to be more evidence pointing to the ineffectiveness of our existing controls - AV in dealing with these threats.

The most worrying thing about the trend of 0-day exploits is how many unpatched exploits exist which haven't yet been reported? Based on the ability for researchers to turn these into profits I would bet that there are an equal number.

Thursday, December 4

Consumer Benefits of Credit Card Security

Recently, new types of credit card security features have be debuted, such as this one from Visa. And as some of the comments on Bruce Schneier's blog point out, its questionable how effective this is. I want to figure out what the motivation is behind these ideas, as it appears banks and the major credit card brands are not completely transparent about the benefits to the consumer.

My example is this, one source has that in 2005 $2.8 million was lost due to credit card fraud from Visa and MasterCard in Canada alone. These costs are absorbed by the credit card companies as they protect their cardholders from liability, but as can be expected these costs are directly applied to the card brand customers, people and merchants, in the form of fees and interest rates.

Now lets say that card brands can deploy a technology to eliminate 90% of this fraud and associated insurance and liability costs. Likely a large savings both in Canada and globally. Would we, the public and merchants, expect a reduction in the cost of these services that reflects a competitive portion of the savings?

What I believe is more likely is that the card brand companies will:
  1. Use these new technologies to apply liability for loss and fraud on the cardholders directly - citing the security of the services.
  2. Increase their profits by maintaining or increasing service charges and fees.
  3. Increased inconvenience for consumers and merchants using the services.
Is this better than the current situation for consumers and merchants?

Monday, December 1

Apple recommending OSX anti-virus? Is this true, do I run out and buy it?

As others have pointed out on November 21st, Apple silently recommends anti-virus products for OSX.
"Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one application to circumvent, thus making the whole virus writing process more difficult."

This isn't as clearly written as many of the other Apple support articles, and there are a few related topics which should have more clarity.
  1. Who is the audience for this advice? Is it the majority of non-technical mac owners who are unaware of the types of malware? Or is it all OSX users?
  2. Are they also recommended that multiple, as in more than one, anti-virus utilities be used at once? If so how many are recommended, two, three?
Apple also has a handful of other references to anti-virus on OSX 10.5. As stated in a support article from April:

"6) Check for Viruses
Macs are far more less likely to get a computer virus like Windows PCs are prone to but that doesn't mean it's impossible. If you don't already have antivirus software, you may want to consider making a purchase. If you have the software installed, be sure to keep your virus definitions up to date—you can find the latest updates on your software manufacturer's website."

Again Apple recommends considering purchasing this software, but doesn't supply any criteria to help a user with this consideration.

When looking at OSX 10.5 security features Apple provides a brief description of ways that Leopard protects the user from potentially harmful practices of downloading and running malicious programs, but other than sandboxing and alerting users to potentially unsafe downloads, there isn't much information in this marketing material.

Digging a bit deeper though, shows slightly more information. Apple has published a security tech brief for 10.5. This document provides a really good description of each of the security features in 10.5. I've extracted a few which in my opinion are the most relevent to preventing malware infections - which most anti-virus software helps to do.
  1. User permissions model. By default OSX operates with restricted user access (unless you configure it otherwise). This means that regular users, and even administrative users, do not have access to modify items in the "system" domain without additional authorization. So even if Safari is susceptible to some vulnerability, or a bad email attachment is run, it likely won't be able to escape the user's limited access.
  2. Runtime Protection. OSX like other modern operating systems does provide protection from common virus behaviour like buffer overflows and other memory and execution vulnerabilities. 10.5 uses execute disable, library randomization and sandboxing to keep applications from hijacking system execution.
Still, nowhere in this more detailed tech brief does apple mention the recommendation to install and use anti-virus software. So where does this leave us? Should we follow Apple's recent, albeit quiet, advice to install ClamavX?

My personal opinion on this, is that anti-virus has become a more of a security risk than control. Wha?! Before you discredit this post let me explain.

My opinion is based on anti-virus software use by 99% of the Internet community, people who haven't been educated on how virus' work, are spread, and cause damage. These people likely have been affected by a virus infection in the past, and after a co-worker calls them to inform them that they've been sending infected messages out, take their computers to the local big-box retailer and they sell them an anti-virus product after re-imaging their PC.

Further more, lets also assume that the best of these anti-virus products are effective in stopping 99% of the virus's encountered, which is ridiculously high but illustrates my argument well.

For this average user, they have now been comforted that as they open the email attachment from the prince of Nigeria, that the anti-virus software will catch and protect them from the malicious program which will make their PC a part of the growing population of botnets. But now lets assume that 1 out of every 100 attempts will still be successful in by-passing the anti-virus software, and now this user is infected again.

This comfort and confidence is the problem - if this user had learned the basics about how malware works and is spread, and been educated on the simple day-to-day activities which put them at risk, I would argue that at some point, this knowledge would be more effective at stopping the infection than the anti-virus software.

So does anti-virus software make us less secure? Not really, it's the false sense of security it invokes and confidence in these solutions to make us 100% secure that make us less secure.

My recommendation for the majority of Internet users is to gain and maintain awareness of activities that make us susceptible to abuse, and as part of this education learn what anti-virus is good at, and use it for these purposes.

So Apple - Cudos on providing an operating system which reduces the ability for our computers to become infected, and reduce our reliance on anti-virus solutions, but I think more could be done to educate your customers on responsible secure Internet use.

Thursday, November 27

Passive Information Gathering Tools for Firefox

There are all kinds of great tools popping up these days to help the security professional with their job. Here are a couple of the ones that I've found useful:

PassiveRecon in particular automates, to some degree, the mining of social and public information which is available about a target without actually connecting in any way to the host or web service.

AdvancedDork provides an easy way to use the advanced Google options (googledorking) to find additional or more refined public information regarding what's highlighted.

Anytime a utility can help cut down on the amount of time it takes to collect information, and allows more time to be spent on analyzing what's found it gets put into the toolbox.

Monday, November 17

Distributed SQL Injection Analysis - Excellent Description!

The guys over at Bloombit (British Columbia based firm) have provided an excellent analysis of an automated encoded SQL Injection attack which describes many of the techniques that malware distributors are using these days. And also provides some good pointers on how to prevent them. A few of the key points I got from the article:
  • Enforcement of parameterized SQL statements is important where possible.
  • Google and other web-based search tools are used to find starting points to conduct their probes (find your sites before they do!)
  • Profit motivated criminals drive this issue - not script-kiddies.
If you are involved in coding any database driven Internet sites or applications give this a read.

Tuesday, November 11

Google and AARP Security and Privacy Videos

Google and the former Assocation of American Retired Persons (AARP.org - via wikipedia) have co-produced a set of six videos geared to help educate the masses on the types of things people should be doing to protect themselves better on-line. The messages here are great for the average Internet user, and contains information on Safe starts, Practicing password safety, Sharing your content safely online, Know what's posted about you online, Shopping safely online, and Avoiding phishing scams.

Free Downloadable Log Management Tool - Q1 Labs

Q1 Labs has released a free version of their QRadar product - albeit a limited version (50 events / second). For any small or medium sized business that's looking to get a handle on their security logs from hosts firewalls and ID/PSs this seems like the right price point. Be aware that they are collecting contact information to that a sales guy will call and hopefully upsell you to the paid for enterprise version.

Thursday, November 6

CIPS - ICE Conference Presentation

I was lucky enough to be invited to speak at the recent Computer Information Processing Society's ICE Conference with one of the senior auditors from the Office of the Auditor General of Alberta. Our talk regarding the Myths of IT Risk and Control was well received and had a lot of questions and interest from the crowd.

I've posted a copy of the presentation in both PDF and PPTX format for anyone that would like a copy. And if anyone would like me to present on this topic to their organization please just let me know.

Inaugural Blog Post

This is the first blog post to the TripleCheck Consulting Blog. I hope to be adding interesting and engaging stories and reports from the Information Security and Risk Management world.

Please stay tuned...