Linux Security Week: March 13th 2006

More than 60 years after the end of World War II, a distributed computing project has managed to crack a previously uncracked message that was encrypted using the Enigma machine. The M4 Project began in early January, as an attempt to break three original Enigma messages that were intercepted in 1942 and are thought never to have been broken by the Allied forces.

news/cryptography/distributed-computing-cracks-enigma-code

A few weeks ago, I attended a meeting of university presidents and representatives of the CIA and FBI convened to discuss campus issues related to national security. The goal of the meeting was to establish a dialogue between the federal government and our major universities concerning topics such as immigration policies, export of sensitive technology, the protection of intellectual property and so forth. This was the second meeting of our group that I was able to attend, and I found the discussion to be both positive and hopeful. We are trying to find the proper balance between important national security concerns and our ability to attract the best and brightest talent from around the world, share information internationally and maintain on our campuses an open environment for information exchange.

It must have taken vast amounts of self-discipline to avoid radiating smugness: When American Water was infected by the Sasser worm last year its exposure was limited to just 19 hosts out of a potential 10,000, thanks to early detection and active intervention. During the same period, a sister company suffered 4000 infected machines - virtually its entire infrastructure. "The remediation alone, much less the business interruption quantification, was in excess of a half a million [US] dollars value to us," says American Water director, security, Bruce Larson.

It's about time I summarize all my February's Security Streams, you can of course go through my January's Security Streams as well, in case you're interested in what was inspiring me to blog during January.

There is value in finding vulnerabilities. Yet many people believe that a vulnerability doesn't exist until it is disclosed to the public. We know that vulnerabilities need to be disclosed, but what role do vendors have to make these issues public?

In early February, antivirus firms warned customers about a computer virus programmed to delete files on the third of each month, but almost every company called the program by a different name. A month later, the companies still use a hodge-podge of monikers for the program: Blackmal, Nyxem, MyWife, KamaSutra, Blackworm, Tearec and Worm_Grew all describe the same mass-mailing computer virus. The slew of names underscore that--while antivirus companies have been able to agree on the name for some threats, such as the recent Mac OS X worms--at other times, the companies instead go their own way and race to get public acceptance of their name for a particular threat.

A site I was recently monitoring disappeared these days, so I feel it's about time I blog on this case. I have been talking about the emerging market for software vulnerabilities for quite some time, and it's quite a success to come across that the concept has been happening right there in front of us. Check out the screenshots.

It was a typical first-thing activity. I'd turned my computer on, run the spam filter, and was checking through it for e-mails that shouldn't be there. As sometimes happens, there were a couple, and a couple of clicks later, McAfee SpamKiller sent them on their way to my e-mail. This is a habit that I've formed over the years because I've learned that despite the technology, false positives do exist and sometimes the e-mail that's on the kill list is important.

While waiting for ADSL to be enabled in my area, which (I've been told) will happen soon, I did some tinkering with my Gentoo Linux workstation to make it more protected against remote attacks, and I thought of compiling a list of security measures against the dangers of full-time Internet connection. Obviously the list is not complete, but it has tips that can surely help.

Online fraudsters have developed a new phishing technique in response to increasingly aggressive moves to identify and shut-down traditional phishing sites. Dubbed "smart redirection attacks," the new threat is designed to ensure that potential phishing victims always link to a live website.

Putting in place an organisation-wide mobility strategy will rise up the IT department agenda in 2006 and this, I am afraid, will cause pain. In many large enterprises, about 20% of the workforce has a company-provided mobile device ... That figure will rise during the next few years. According to research firm Forrester, CIOs in Europe and the US rate mobile workforce issues as a top five priority and CIOs worldwide expect mobile workforce issues to increase in importance.

Deleting a file with the rm command merely adds a file's data blocks back to the system's free list. A file can be restored easily if its "freed" blocks have not been used again. shred repeatedly overwrites a file's space on the hard disk with random data, so even if a data recovery tool finds your file, it will be unreadable. By default, shred does not delete a file, but you can use the -u or --remove switch to delete it.

You can use shred on a file or entire partitions or disks, but you cannot use shred on the partition from which you are running it. In other words, if you have Ubuntu 5.10 installed on /dev/hda1, you cannot boot into it and run the command shred /dev/hda1. Instead, try using Knoppix or another live CD with shred if you wish to work on an entire partition.

An upcoming version of Firefox will include protection against phishing scams, using technology that might come from Google. The phishing shield is a key new security feature planned for Firefox 2, slated for release in the third quarter of this year, Mozilla's Mike Shaver said in an interview Tuesday.

Protecting data is not just a job for technologists. It also takes physical security and business continuity experts. At information-intensive companies, data centres don't just hold the crown jewels; they are the crown jewels. Protecting them is a job for whiz-bang technologists, of course. But just as important, it's a job for those with expertise in physical security and business continuity. That's because all the encryption and live backups in the world are a waste of money if someone can walk right into the data centre with a pocket knife, a camera phone and bad intentions.

A lot of recent phishing events occured, and what should be mentioned is their constant ambitions towards increasing the number of trust points between end users and the mirror version of the original site. The use of SSL and the ease of obtaining a valid certificate for to-be fraudelent domain is a faily simple practice. Phishing is so much more than this, and it even has to do with buying 0day vulnerabilities to keep itself competitive. How should phishing be fought? Educating the end user not to trust that he/she's on Amazon.com, when he just typed it, or enforcing a technological solution to the problem of digital social engineering and trust building?

For a while, the wireless Internet connection Christine and Randy Brodeur installed last year seemed perfect. They were able to sit in their sunny Los Angeles backyard working on their laptop computers. But they soon began noticing that their high-speed Internet access had become as slow as rush-hour traffic on the 405 freeway.

news/network-security/hey-neighbor-stop-piggybacking-on-my-wireless

There are very few open source tools I’ve yet to see that are more useful then Ettercap. What is Ettercap, you may ask? I’ll tell you. Ettercap is a Ethernet/LAN Sniffer. It allows you to sniff packets on a LAN network, but that’s not the kicker. Ettercap can sniff packets on a switched network.

There are two major devices used to connect computers together. A Hub, and a Switch. A hub is a dumb device. It takes the data it receives in one port and simply sends it out all the other ports on the unit, regardless of the destination. Thus, sniffing traffic on a hub is relatively easy- all you have to do is “listenâ€