Friday, February 01, 2008

A modern Doomsday

Middle-Eastern Internet services have been severely disrupted by the failure of an undersea cable linking Egypt to Italy. There are backup connections, of course, including satellite and other cable connections but their capacity is limited, hence Internet traffic in some countries in the region is experiencing delays and probably failed connections due to timeouts.

Thanks to packet switching technology and multiple routes, the Internet as a whole is highly resilient. Undersea cables can often be repaired within days or weeks. But imagine what would happen if the Internet went down, and stayed down. Not 'stayed down for a few minutes' or hours or even days, but for an extended period perhaps indefinitely.

There are various horrific scenarios that could cause this to happen e.g.:
- Widespread technology failure, disrupting the packet switching backbone;
- Deliberate action by one or more nation states in wartime, severing critical connections and/or injecting massive amounts of spurious traffic at multiple points to disrupt;
- Natural events such as solar flares/X-ray emissions from the sun, storms etc. damaging critical equipment and links;
- Cyberterrorist attacks on the Domain Name Systems or other critical elements of the Internet, perhaps combined with conventional terrorist attacks on key nodes, cables and satellite ground stations;
- Worms or other malware, in other words, software agents swamping or damaging the network;
- "Something else" - the classic contingency planning scenario. We don't know exactly what might happen. It could be something completely novel and unanticipated or a chance combination of more than one type of event, known as 'bad luck'. For true contingency planning purposes, the exact cause and nature of the incident is irrelevant: we need to be ready to cope with whatever actually happens.

With a moment's thought, the horrendous consequences of such an incident start to become clear. The developed nations are highly reliant on the Internet and would suffer economic and social consequences very quickly. Developing nations are also actively using the Internet for eCommerce and communications with the rest of the world. The Internet has penetrated even the least developed third-world countries, and disruption to first world aide programs would have consequences there too.

We're hardly on the same scale as Google, eBay and Amazon but at a local level, our own small business would suffer within days if the Internet went down. We use the Internet for marketing and promotion, sales and delivery, research and communications. There are fallback delivery mechanisms - sending CD-ROMs in the post or direct dial-up access - both of which are limited, wouldn't work very reliably and would increase our costs. We could resort to old-fashioned research methods but would miss the ready, free access to up-to-date information security news from around the globe. Our marketing and sales would suffer the most as conventional print, TV and radio advertising is far more expensive and limited in scope. That, in a nutshell, is our own risk assessment.

Larger e-enabled businesses (such as the entire financial services industry) would su=ffer immediate problems, others might hardly notice at first, at least until their suppliers, partners and/or customers started to fail. Government departments and utilities would suffer quite quckly, causing knock-on effects as the national infrastructures started to unravel. If petrol companies and airlines were disrupted, well we'd have to get used to walking or cycling to work, if indeed work existed. Civil disruption could have serious consequences for personal safety and security.

We're just a few paragraphs into this very brief overview but the 'worst case scenario' is shaping up badly. This is starting to sound like one of those science fiction doomsday stories.

On the upside, TV, radio and print media would be severely disrupted too so we might not get to hear too much about the civil disruption outside our barricaded front doors. Some of us will retreat to our caves.

What kind of contingency plans would or could you make for "the Internet is down"? Some of the more obvious things might be to retain or stockpile ordinary modems (assuming that the telephone networks are running ... but, oh dear, they are using VOIP and, no doubt, sharing a lot of the Internet technologies and links) and generally retain (or rather rebuild) the ability for non-electronic commerce and communications.

More resourceful organizations might build their own private networks to run in parallel with the Internet - such as the financial services, military and other special purpose networks. These are expensive but the greater concern is to ensure they are adequately isolated from the Internet in fact. Supposedly private bank ATM networks have been known to crash due to Internet worms so finding and closing those worm-holes must be a priority. That's definitely something we can do today.

What else would you suggest in the way of contingency measures? Any ideas you'd like to share? Just post a comment ... while your Internet connection is still running, please.

Labels: , , ,

Links to this post:

Create a Link

Sunday, October 07, 2007

Security camera security

If your CCTV security camera system uses IP transport to cut costs, don't forget to factor the cost of network and device security into the mix. It has long been known that many IP-enabled CCTV cameras are pumping live video onto the Web with no encryption or access control. It now appears that exploiting security vulnerabilities in the camera controllers may allow hackers (or bank robbers) to manipulate the video stream, for example replacing it with a 'blank scene' while they crack the vault.

Labels: ,

Links to this post:

Create a Link

Wednesday, September 26, 2007

Credit card numbers posted on eBay forum

Someone appears to have posted a load of personal data including credit card numbers on an eBay discussion forum, paradoxically one on trust and safety. Around 1,200 eBay users' details may have been compromised.

Why anyone would do this remains a mystery. Is it just some sort of publicity stunt, or a hacker's brag?

eBay shut down the forum and pulled the pages about an hour after being informed of the incident. There's more about the incident on an eBay blog.

"eBay spokesperson Nichola Sharpe said Tuesday afternoon that posts made on the Trust & Safety board early this morning contained name and contact information for 1,200 eBay members and called the person posting the information a "malicious fraudster." She said the incident was not the result of a security breach from eBay and could have been obtained as part of an account takeover."

It's possoble that a merchant's account may have been compromised, I guess.

Labels: , ,

Links to this post:

Create a Link

Saturday, August 18, 2007

Security awareness success in the US Army

Details of audits of US Army websites and blogs run by soldiers, disclosed under the Freedom of Information Act, reveals that far more security policy breaches occur on official Department of Defense websites than on blogs. The audits were conducted by the Army Web Risk Assessment Cell, a special unit with a remit (evidently) to minimize unauthorized disclosure of sensitive military information via the Web.

It seems to me the Army was absolutely right to highlight the information security risks relating to blogging. I believe the audit results reflect the outcome of a highly successful security awareness program. If this issue had not been addressed so effectively, I'm convinced there would have been far more noncompliance issues, in other words this is a lesson to us all.

In respect of security awareness programs and policy compliance, 'the military' have a significant advantage over most of us in that the workforce is specifically trained to respect authority and follow orders - or at least, that is the classical view. In fact, I understand modern soldiers are increasingly being taught to think for themselves and operate autonomously, albeit within a highly structured (literally 'regimented') operating framework and, when necessary, at gunpoint. The traditional approach to the blogging security issue would presumably have been to send out an order banning blogging. What actually happened was more subtle: Army bloggers were instructed to register their blogs with commanding officers and pre-clear what they publish. 'Blog responsibly' is a rather softer message but the audit results seem to indicate its effectiveness in this situation.

Labels: , , , , , , , ,

Links to this post:

Create a Link

Friday, June 15, 2007

What the white hats are up against

In its usual tongue-in-cheek fashion, The Register describes the Black Hat world through ten features:
1. The Black Hats form a well integrated community that shares knowledge effectively
2. Becoming a Black Hat is a career option even for those who are not super geeks.
3. There are even specialist virus tools designed to circumvent specific AV products.
4. There are SDKs for the more advanced hackers.
5. There's a market for your data.
6. There are botnets to rent.
7. Some rogue websites are very subtly managed.
8. Good hackers know how to stay safe (they stay abroad)
9. The banking system has its channels
10. Not all businessmen are entirely averse to the odd hack (on a competitor)

In the sense of "know your enemy", the article presents an interesting perspective.

Labels: , , , , , ,

Links to this post:

Create a Link

Monday, June 04, 2007

Net Crimes & Misdemeanors - book review

Read the review
Net Crimes & Misdemeanors - Outmaneuvering Web spammers, stalkers, and con artists
explores the dangers of the online world covering a broad assortment of Internet security issues, with useful descriptions and helpful advice for all Web users. This is a good security awareness book for anyone who is relatively new to the net, combining realistic threat descriptions with pragmatic security advice.

Labels: ,

Links to this post:

Create a Link

Friday, June 01, 2007

Wi-Fi not entirely vulnerable to jammers

A well-written article discussing the potential threat of wideband noise sources to Wi-Fi networks concludes that it is not as easy as some people assume to jam Wi-Fi. The use of frequency-hopping and spread-spectrum techniques (which are different, by the way) in the microwave bands makes Wi-Fi substantially less vulnerable (though admittedly not totally immune) to interference than it might appear.

The article systematically dismantles naive claims that a "simple 100W broadband noise generator" would knock out Wi-Fi networks within a couple of miles. The main argument is that the 100W of energy would be spread across 0-2.4GHz if the noise generator were truly simple (i.e. presumably untuned), resulting in a low energy density in the Wi-Fi band/s. In practice, I suspect a jammer would probably design his system to produce most of the 100W in the specific microwave frequencies used by Wi-Fi.

A 'proof of concept' noise generator should not be too difficult to construct although getting 100W at microwave frequencies is a technical challenge unless you have the $$$ to buy commercial microwave amplifiers ... or the technical nouse perhaps to adapt a Klystron from, say, a microwave oven.

Don't try this at home folks. High power microwaves are used in ovens because they cook things - your cornea, retina and brain, for example.

Labels:

Links to this post:

Create a Link

Wednesday, April 25, 2007

Boundary? Wot boundary?

Disappearance of the network boundary is a 28-page ISF Digest (report of a special interest group) from the Information Security Forum about the increasing Internet connectivity of today's typical corporation. As the traditional fortress wall/network perimeter is dissolved, the boundary security controls can expand to somehow incorporate untrusted devices Out There in webInterland or contract to protect devices In Here from all other devices [this is a false dichotomy if changes may take place in both directions at once]. The report recommends gradual evolution of current security controls in the short term and investigation of other options in the longer term.

Labels:

Links to this post:

Create a Link

Friday, April 20, 2007

The lure of VA Tech

Hot on the tail of the shocking massacre at VA Tech comes news of spammers and probably other scamsters using the incident as a lure for their evil deeds. According to a message on SANS Internet Storm Center today, spammers have sent emails inviting recipients to follow a link for video of the shooting ...

By the way, the SANS ISC makes a good default home page if, like us, you want to keep up with infosec news.

UPDATE: Wired has a piece on this too.

More network security links

Labels: ,

Links to this post:

Create a Link

Tuesday, April 17, 2007

Fortune 1000 companies botnetted

An article in the New York Times on spam and botnets quotes some ballpark figures:
- 11% of the 650 million computers on-line contain botnet code
- 250,00 new systems get botted every day
- 80% of all spam originates from botnets

That little snippet of news came from Support Intelligence, a commercial company that is monitoring the Internet for spam, botnets etc., analyzing the origins and publishing some of the more interesting details in their blog (as well as selling the data to their clients). Many big-name companies are named and shamed, in other words spammers have evidently infitrated major corporate networks, setting up botnets that spew forth spam through the corporate email systems, some of which run mainstream antispam software such as Ironport (perhaps it is configured only to spam-check inbound email?).

More network security links

Labels: ,

Links to this post:

Create a Link

Monday, April 16, 2007

Pen testers' confidence boost

Penetration Testing with Confidence: 10 Keys
to Success
is a SANS webinar on Tuesday, April 17th at 1PM EDT (17:00 UTC). According to the blurb:
Penetration testing is fast becoming essential for IS professionals
seeking to comply with security mandates, assess defensive IT
infrastructure, and assure customers of privacy protections. At the
same time, a poorly planned or executed penetration test can turn
into a costly liability. Whether you're an experienced pen tester
or a first-timer, this webcast will give you the insight you need to
approach all pen tests with confidence.


More network security links

Labels:

Links to this post:

Create a Link

Sunday, April 08, 2007

NIJ guide to investigating hi-tech crimes

The National Institute of Justice is publishing a series of guides for those engaged in responding to, investigating and presenting evidence in US courts about high-technology crimes. In 137 pages, Investigations Involving the Internet and Computer Networks, the latest publication, covers investigations involving email and websites, Instant Mesage, chat rooms and IRC, file sharing networks, network intrusion and denial of service, listservs and newsgroups. It provides basic advice on technology and legal issues, with a brief nod to IT forensics. The guide a little outdated in places but us a useful introduction to the requirements.

More network security resources

Labels: , ,

Links to this post:

Create a Link

Tuesday, April 03, 2007

Microsoft animated cursor fix

A bug in Windows' handling of animated cursor files is being actively exploited by The Dark Side. Those of us on the Light Side are advised to deploy an emergency patch just released by Microsoft ... or consider moving to an alternative, less bug-ridden operating system sharpish, assuming such a beast exists.

More network security resources

Labels: , ,

Links to this post:

Create a Link

Saturday, March 31, 2007

Internet Exploder

Microsoft acknowledges that a recent Internet Explorer security patch fixed IE6 but not the latest IE7. Exploit code is apparently 'in the wild'. Perhaps now is a good time to consider changing to Firefox or one of the other non-M$ browsers?

Another advisory concerns a security flaw in Windows' handling of animated cursor files, which is also being actively exploited 'in the wild'. Time to take a look at Linux, maybe?

More network security links

Labels:

Links to this post:

Create a Link

Thursday, March 29, 2007

Network security awareness module released

Is it a funnel or the business end of a vacuum cleaner?
We've released an updated and extended awareness module on network security for April 2007, incorporating materials on securing wireless networks, Web browsing and a variety of other networking security issues.

See the network security links collection here

Labels: ,

Links to this post:

Create a Link

Thursday, March 01, 2007

Sun Telnet daemon worm in the wild

Sun Microsystems warns that a worm exploiting a security flaw in their Telnet daemon is 'in the wild' i.e. currently infecting Sun systems. Sun has evidently issued a patch but a better solution is, um, not to use Telnet, especially across the Internet. SSH is a simple, much more secure replacement in most situations, using SSL to encrypt the network traffic.

More network security links to follow next month

Labels: ,

Links to this post:

Create a Link

Monday, February 26, 2007

Book review: Google Hacking

Google Hacking for Penetration Testers by Johnny Long is a terrifying book if you are a slightly paranoid information security professional at a major corporation. You'll soon be avidly turning the pages with a growing look of shock and fear on your face, gripped by the unfolding horror story. Google Hacking puts the spotlight firmly on those dark places that many security managers fear to tread: firewall, IDS and IPS configurations, security patching practices, web application security ... need I say more?

Read this book if you dare.

Labels: ,

Links to this post:

Create a Link

Wednesday, February 21, 2007

New NIST security standards

NIST SP 800-45 Guidelines on Electronic Mail Security advises on the installation, configuration and maintenance of secure email servers and clients. It presents recommendations to secure mail server operating systems and applications, protect mail servers, administer mail servers securely plus advice on protecting individual emails and securing mailbox access. The email security standard is a revised version of the original 2002 standard. Other newly-released NIST standards cover intrusion detection and prevention (SP 800-94), and securing 802.11i wireless networks (SP 800-97).

More email security, web/network security and wireless network security links

Labels: ,

Links to this post:

Create a Link

Monday, December 25, 2006

Congressional aide socially engineered

A congressional aide has admitted asking two jokers at Attrition.org to hack into his college's network and adjust his college grades. The jokers (who he evidently believed to be l33t hax0rs, except that he would have not the foggiest idea what those words mean) led him into believing they would do what he wanted, and in the course of the incident, got him to reveal his Social Security Number and other personal information to make their hacking job easier. The email exchange is very amusing: the victim had no clue that he was being taken for a ride, even providing photographs of a [secret] squirrel at one point to validate his location. Be sure to read the news piece on Network World that revealed the victim's details and printed his admission and apology for making a big mistake ... and led to him being fired ... but his 15 minutes of fame now include a Wikipedia entry.

More social engineering, hacking and accountability resources

Labels: , , , , ,

Links to this post:

Create a Link

Thursday, December 14, 2006

"Client-side attacks" social engineering webcast

Core Security Technologies is offering a webcast on "client-side attacks" at 2pm EDT on December 19th and December 21st. The press release is not entirely clear about what they mean by "client-side attacks" but two examples are quoted: opening a malicious Word, Excel or PowerPoint document sent via e-mail, or browsing malicious web sites that exploit vulnerable client-side code.
According to the PR, "During this 45 minute webcast you learn how:
* to assess how vulnerable your information assets are to spear phishing attacks targeted at end users;
* Outlook, IE and other applications can provide an attacker an easy path into your organizations;
* a social engineering attack can be successfully deployed against your network; and,
* to better protect your organization’s critical assets."
I presume they will promote technical security control measures but I hope they will also promote security awareness to address the human vulnerabilities at the root of such attacks. We'll see.
More social engineering resources
[I have no connection with Core Security Technologies, apart from our common interests in social engineering and information security]

Labels: , ,

Links to this post:

Create a Link

Tuesday, December 12, 2006

Bank robbery, the social engineering way

A classic social engineering attack on a bank, as described by the boss of a penetration testing company, is just as scary as the case studies in Ira Winkler's Spies Among Us. The perpetrator gains access to the bank network simply by posing as a photocopier technician. It's scary because the story rings true. It's a typical Security Manager's nightmare scenario. The customer service ethic of the front line bank staff trumped any security awareness they might have had. The inadequate technical security controls on the bank LAN are entirely credible. [Thanks to my friend Alisdair for sharing this link.]
More social engineering resources

Labels: , ,

Links to this post:

Create a Link

Friday, December 08, 2006

The fallibility of technical controls

A piece apparently due to be published in Computer Weekly next Tuesday outlines a range of network security issues relating to mis-configuration of IT equipment, and then (almost as an afterthought) ends with the following:
"... security needs to be a mix of people, process and technology. The best security comes from having well-trained and motivated staff, who will not click on dodgy e-mail attachments, and will not be lured into spyware-infected websites. And like every other aspect of the security jigsaw, security training and awareness is not a one-off exercise. It needs to be a continuous programme of education, incentive and information."

The fact that IT systems and networks are misconfigured by people surely implies that security awareness programs need to include IT professionals?
More on network security and security awareness

Labels: ,

Links to this post:

Create a Link

Tuesday, October 17, 2006

When POTS becomes VOIP

The transition from POTS (Plain Old Telephone System) to VOIP (Voice Over IP) is likened in an article by CSO Magazine to Swedes changing the side of the road on which they drive. It's a dramatic analogy but acts as a worthwhile counterpoint to the usual arguments about VOIP simply replicating POTS security issues. In fact, VOIP/IPtel introduces some novel risks:
- Confidentiality: unauthorized disclosure of information by snooping on calls, copying or redirecting them;
- Integrity: change management; authentication of users and security administration;
- Availability: additional complexity caused by implementing new IT/networking equipment to replace tried-and-trusted PABXs; convergence of voice and network technologies potentially creating new unanticipated technical issues;
- Financial: risks relating to the implementation project's business case;
- Operational: changing pattern of use of phone systems may open up novel working practices and business opportunities with unique security/risk implications (e.g. remote Internet teleworking potentially including offshore, wireless phones).
Analysing the risks on another axis gives a different view:
- Threats: accidental misconfiguration or operator errors causing software/system/network failures; man-in-the-middle attacks on voice calls (manipulating voice traffic in real time to change conversations);
- Vulnerabilities: new technology (compared to POTS); all the usual information or IT security vulnerabilities (e.g. bugs); all eggs in one basket;
- Impacts: simultaneous loss of network data and voice capability causing business disruption; disclosure of confidential information; regulatory or legal implications such as retention of calls.
More web and network security links

Labels: , , , ,

Links to this post:

Create a Link

Friday, October 13, 2006

Pre-incident forensics

Managers seem to expect forensic evidence to appear as if by magic when an employee is caught committing fraud or circulating porn on company IT equipment. The reality is that, while system, network and firewall logs usually record some information, it is unlikely to be sufficient or suitable for forensic purposes unless the logs and controls have been designed and maintained with that potential use in mind. Aristotle has an unusual network usage/content monitoring product that claims to address this kind of controls gap. It is targeted at schools and offices, for example identifying children contemplating suicide or employees stealing corporate data. It retains forensic evidence and provides the reporting tools to use of it.

More incident management links

Labels: , , ,

Links to this post:

Create a Link