Linux Security Week: March 6th 2006

A recently discovered vulnerability in Google Gmail allows automatic javascript execution when using the preview function. While Google filters javascript sent among Gmail accounts, e-mail from outside accounts such as Yahoo! are not filtered.

Increasingly computer security is focusing on the human component within a system. About five years ago, security research and practice accepted that most users do not comply with security policies, which is what makes attacks on computer systems possible. People are the weakest link in the security chain and, as reformed hacker Kevin Mitnick points out, social engineering attacks succeed because hackers now make the effort to acquire knowledge of these human factors, whereas the designers of security systems do not.

Based on the many responses we got regarding the 'Packetslinger' diary, here a few notes on how to setup a penetration/cracking exercise. As a remark: Laws change from area to area. Whatever you do, check your local laws and regulations. Corporate policies, university ethics guidelines and ISP contracts may have to be consulted. Any attack, even as simple as a portscan, should only be performed with written permission. Even in a lab environment, it may be a good exercise to go through the motions of obtaining written permission from the instructor. It is not always easy to identify the person who has to provide permission. But in general, this should be the 'network owner'. Remember that part of a corporate network may be owned by an ISP, and not the company (or university).

I am 25 years old and a current resident of Columbus, Ohio. I have been publicly active in the computer security scene since around 1998. Most of my research was published through Secure Network Operations, where I served as the Head of Research and Development. Since SNOSoft has dissolved, I have been focusing my time on a project called Digital Munition.

BP has provoked heated debate in the UK technology industry with plans to move thousands of laptops off its LAN claiming it will make the business more secure. BP said hiding behind a firewall simply creates a false sense of security and so 18,000 of its 85,000 laptops now connect straight to the internet, even when they are in an office.

A final practical test for a computer-security class has network administrators up in arms. According to handlers at the SANS Institute, a professor at a university (both have been promised anonymity) has assigned his students homework requiring them to perform attack reconnaissance on an Internet server.

Most people who use e-mail now know enough to be on guard against "phishing" messages that pretend to be from a bank or business but are actually attempts to steal passwords and other personal information.

Internet: Love it or hate it, Network Address Translation will not be going away soon. It is a common belief that IP addresses are running out. Every device on a network needs to be uniquely identified by its IP address, and the problem is that there are simply not enough IPv4 addresses.

news/network-security/do-we-really-need-to-have-ipv6-when-nat-conserves-address-space-and-aids-security

Operating under the theory that if you kill the head, the body will follow, a group of high-profile security researchers is ramping up efforts to find and disable the command-and-control infrastructure that powers millions of zombie drone machines, or bots, hijacked by malicious hackers.

news/network-security/hunt-intensifies-for-botnet-command-a-controls

A new professional body for information security professionals launched today (Monday 27 February) will help raise the standards of IT security across the UK, leading employers have said. The Institute for Information Security Professionals has won backing from major UK firms, which plan to use it as a benchmark for hiring IT security staff.

news/organizations-events/businesses-back-new-professional-body-to-raise-it-security-standards

The presentation I gave in Washington, D.C., at Black Hat Federal Conference in January 2006. It's about new generation of stealth malware, so called Stealth by Design (SbD) malware, which doesn't use any of the classic rootkit technology tricks, but still offers full stealth! The presentation also focuses on limitations of the current anti-rootkit technology and why it’s not useful in fighting this new kind of SbD malware. Consequently, alternative method for compromise detection is advocated in this presentation, Explicit Compromise Detection (ECD), as well as the challenges which Independent Software Vendors encounter when trying to implement ECD for Windows systems.

news/organizations-events/rootkit-hunting-vs-compromise-detection

In this tutorial we are going to improve our website by tweaking out the .htaccess file. Why I wrote this article? Because on the net I have found many articles about this little beast, but every one of them dealt with a specific issue and not look at the overall usage of these files, or they are just too big when you need to do a thing in little time. So I’m trying to collect all the useful bits of data in a monolithic but slim tutorial, which will be updated as I collect more information. But first, let’s see what .htaccess file is.

news/server-security/apache-htaccess-tweaking-tutorial

What do people who renew their driver's licenses, buy hard liquor or donate to a home for elderly and disabled veterans have in common? In New Hampshire, people who did any of those things within the past six months may have had their credit card numbers stolen because of computer security issues (see N.H. state server eyed in possible credit card data breach ).

news/server-security/common-insecurity

Oracle has issued an upgrade to its E-Business Suite 11i diagnostics module containing a number of the security fixes, according to applications security firm Integrigy. In releasing the upgrade, Oracle made an usual move by alerting its users about the security patches, according to Integrigy's advisory. Historically, the software maker has released product upgrades but not disclosed whether they included security fixes, Integrigy noted.

news/server-security/oracle-patches-11i-security-flaws

Received wisdom would have it that transparency makes systems more secure by allowing anyone to view the underlying software code, identify bugs and make peer-reviewed changes. Computer security and cryptography expert Bruce Schneier certainly adheres to that theory. He's been saying engineers should "demand open source code for anything related to security" since 1999. But not all security experts agree.

Google has become the de facto standard in the search arena. It's easy, quick and powerful. For those same reasons that the general user has gravitated to Google, so have the hackers. And as we all know, if the hackers use, the security professionals need to utilize it as well. And it doesn't hurt to have Johnny Long (with help from Ed Skoudis) showing you the ropes. Enjoy this highly informative book. We did!

Basic BIOS password crack - works 9.9 times out of ten. This is a password hack but it clears the BIOS such that the next time you start the PC, the CMOS does not ask for any password. Now if you are able to bring the DOS prompt up, then you will be able to change the BIOS setting to the default.

Ernst and Young should go ahead and pony up for its own suite of transparency services. The accounting firm failed to disclose a high profile loss of customer data until being confronted by The Register.

Ernst and Young has lost a laptop containing data such as the social security numbers of its customers. One of the people affected by the data loss appears to be Sun Microsystems CEO Scott McNealy, who was notified that his social security number and personal information have been compromised. While pushing all out transparency for its customers, Ernst and Young failed to cop to the security breach until contacted by us.

Ernst and Young appears set on establishing a laptop loss record in February. The accounting giant has lost four more systems, according to a report in the Miami Herald. A group of Ernst and Young auditors toddled off for lunch on 9 February, leaving their laptops in an office building conference room. According to security footage, two men entered the conference room a couple of minutes after the Ernst and Young staffers left and walked off with four Dell laptops valued at close to $8,000, the paper reported.

Next, Bubrouski's phone started receiving SMS sports scores and news from ESPN, the sports cable network, which had struck up a partnership with Verizon.

As firms move towards converged voice-data IP networks, IT departments will increasingly become responsible for the physical security of buildings via deployment of systems such as biometric access controls, IP-CCTV and card readers, new research has predicted. A third of the IT directors surveyed in a new study by research firm Vanson Bourne Limited said that, as a result of being able to control physical security systems over IP, the area of "security over IP" will become their responsibility. In the manufacturing sector, 57 percent expected their departments to become responsible for physical security, and in the retail, distribution and transport sector it was 32 percent. In other commercial sectors, it rose to 36 percent, while it fell to only 6 percent in the financial services sector.

During the past two decades, the shift from paper to electronic filing of business documents introduced a new challenge: meeting the requirements of litigation discovery. Not only are organizations keeping more information; the vast amounts of email messages and other types of documents are typically not organized in a way that facilitates quick, cost effective extraction from personal and enterprise storage.

If you’re responsible for the security of your company’s information, your role extends to protecting documents required by discovery requests. Are you prepared to assure your executive management, or to testify, that you’ve done everything reasonable and appropriate to meet the court’s expectations?

Computer users' identity information is managed online today by several different data collection agencies. But imagine the freedom people would feel changing their address with one keystroke? Microsoft is working on such technology with its InfoCard identity metasystem. Now IBM, Novell and startup Parity Communications are joining the Eclipse open software foundation and Harvard Law School's Berkman Center for Internet & Society to tackle the challenge.

The three companies and are contributing code to the "Higgins Project," designed to give people more control over their online identity information.

news/privacy/manage-your-own-identity-online

The U.S. Justice Department has denied requesting anything from Google that could threaten the privacy of the search engine's users, as the company recently contended. And by trying to block the government's efforts to review a week's worth of search terms, Google is holding up efforts to protect children from pornography, according to a brief filed Friday by the Justice Department.

news/privacy/feds-googles-privacy-concerns-unfounded

IBM and Novell Monday announced their support for an open source project aiming to give users more control over how information such as passwords and financial details are shared across multiple Web sites.

news/privacy/ibm-led-group-backs-new-identity-manager-tool

At the center of the square off over the access to private personal data online -- a much publicized debate that extends from Beijing to Washington -- stands an uncertain arbiter: the search engine. The companies that operate the most popular search engines -- Google, Yahoo and Microsoft -- are making decisions about how the information they collect about user behavior should be protected, in some cases from the eyes of governments that want to take a closer look but lack a clear legal right to do so.

news/privacy/search-engines-are-at-the-center-of-privacy-debate

With controversy swirling around ID theft and electronic surveillance by the government, what should corporations do to protect customer data? Jim Dempsey, policy director at The Center for Democracy & Technology (CDT), spells out controversial advice such as "gather less data" and seemingly dire warnings such as "if you gather the data, the government will come calling." Whether you view CDT as an advocate or an adversary, its voice is being heard on Capitol Hill, so it's important to be aware of its stance on important corporate data policies and related issues.

news/privacy/got-data-beware-privacy-pitfalls-big-brother

Along with the benefits of networked systems – easy information sharing and the ability to work wherever and whenever – comes responsibility. Professionals in all industries have the responsibility to protect their customers’ (and their own) confidentiality. When professionals access their office networks and exchange information with other organisations, confidentiality is paramount, though not always easy to achieve.

news/privacy/communicating-with-confidence

Professionals concerned with securing the systems that run water and electric utilities, dams, railways and other critical infrastructures are gathering this week in Florida to understand better the challenges facing them and learn how to defend their systems.

news/government/confab-to-examine-security-of-utility-other-control-systems

The State Department started pilot production of electronic passports earlier this month and plans to roll out e-passports for the general public this summer, officials said. The senior official in charge of the project also said that technical issues raised recently about e-passport security would not prevent the general distribution of the documents.

news/government/state-launches-e-passports-rejects-security-concerns

The IRS has not consistently maintained the security settings it established and deployed under a common operating environment (COE), resulting in a high risk of exploitation for some of its computers, according to the Treasury Department’s inspector general for tax administration.

news/government/irs-needs-to-tighten-security-settings-tigta

The Office of Management and Budget today presented its report on managing information security systems to Congress. The report showed steady progress in closing security gaps in federal agencies.

news/government/omb-delivers-positive-it-security-report

Two technology programs at the heart of the National Security Agency's drive to combat 21st-century threats are stumbling badly, hampering the agency's ability to fight terrorism and other emerging threats, current and former government officials say. One is Cryptologic Mission Management, a computer software program with an estimated cost of $300 million that was designed to help the NSA track the implementation of new projects but is so flawed that the agency is trying to pull the plug. The other, code-named Groundbreaker, is a multibillion-dollar computer systems upgrade that frequently gets its wires crossed.

news/government/computer-ills-hinder-nsa