From Bastille Linux to Bastille Unix

In case you hadn't heard, there was a change in name from Bastille Linux to Bastille Unix.

Apparently a domain-name squatter acquired the rights to the domain name that Bastille Linux was using.

He tried to get the original owners of the name to fork over big bucks to get the name back, but they are gonna rely upon the arbitration process to get the name back.

In the meantime, they are gonna take advantage of this opportunity to create a new web-site that reflects the changed nature of their product...

For a period of time, Bastille Linux has been ported to operating systems besides just Linux, so the name really didn't fit any more. They have changed the name to Bastille Unix.

If you have never heard of Bastille Linux, it is a script that walks through the security features of your operating system and either adjusts them for you or teaches you how and why to adjust them. Very good learning tool.

Chalmer

Information Sharing

"FBI CIO: Culture inhibits info sharing" article in Federal Computer Week, by Wade-Hahn Chan about the FBI's reticence regarding sharing information. Chan quotes the FBI CIO regarding "...the intelligence community isn't used to the concept of sharing information and therefore worries about security leaks."

Sharing of information is a very tricky subject...and is tied to a number of interesting issues (these are only a few):

what are the technical requirements for an information sharing solution?
--> keeping bad guys out
--> keeping viruses and malware off the network
--> preventing inadvertant loss of classified data, either due to insiders or due to data leaks
who will be sharing the information?
--> how trustworthy is the network of the partner you are sharing your classified info with?
--> if you share info, what needs to be filtered out, so that they get "actionable" data but not the "crown jewels"
what types of information is being shared?
--> Does the receiving organization, country, company need to have this information or just parts of the information?
--> Can the information being shared lead to a "mosaic effect", where seeming trivial bits of information shared today, can be linked to other trivial bits of information shared yesterday or tomorrow, to allow the partner to infer too much?

Sharing information is not as easy as it might sound.

Chalmer

Suspicious Scans...

Reports in the news of suspicious scans potentially related to a product called ServerProtect. The article describes how there has been some recent increased scanning activity related to TCP port 5168, which is related to a remote procedure call service in ServerProtect. Apparently, a number of machines in a wide range of IP addresses have been scanning this port.

One of the interesting quotes is this:

"Trend Micro issued a warning of its own yesterday based on the ISC scanning alert to virtually beg ServerProtect users to patch ASAP. "We implore security administrators to apply the latest ServerProtect security patch avalable from Trend Micro as soon as possible to protect against any potential attack," read the warning."

It will be very interesting to see if a viable attack is levied in the near future on this vulnerability.

Chalmer

The next world war?

This article by Jim Melnick in the Boston Globe covers some of the salient points associated with cyberwarfare...

It is only a matter of time before the United States and other world powers begin to see the onslaught of calibrated and calculated attacks, in much the same manner as was demonstrated in Estonia.

To quote Mr. Melnick: "Though many US websites are well-protected, a massive denial of service attack could leave many commercial and other sites reeling along the lines of what occurred in Estonia, but on a larger scale. Given that more of our daily lives today depends on the Internet, financial losses could be huge and would be accompanied by a corresponding loss of consumer confidence."

The article also covers some of the issues associated with attacks on infrastructure and military and governmental institutions...

"For 10 years, the federal government's information systems and critical infrastructures have remained a "high-risk" category as assessed by the Government Accountability Office."

The worst part of the equation...as it is in so many things related to security - we have to be successful in defending ourselves 100% of the time and they (the bad guys) only have to be successful once.

Chalmer

Forensics on a hacked Linux box...

The Holliday cracking article (sic) shows how one guy walked through doing forensics on a box. The interesting part of this discussion is two-fold...

first - seeing what the cracker/hacker did to the Linux box
second - seeing the range of comments on Bruce Schneier's website about how the "forensics analyst" went about his analysis - i.e. what to do, what not to do

The take home message for this:

* No computer is truly safe
* When doing forensics, the techniques you use and the decisions you make are gonna be second guessed endlessly.

Chalmer

Using voice commands to take over your computer

Depending on who you ask, it might be an "exploit"...it might not. Speech recognition, that is.

It seems that computers with speech recognition capabilities are susceptible to accepting spoken commands. This has apparently been confirmed by Microsoft in relation to their new operating system, Vista.

Vista will accept spoken commands and execute them. What this means, is that a webpage, such as MySpace or a malicious computer program could play sounds that will interact with the speech recognition program, and initiate malicious activity on your computer, such as file deletions, etc.

Such a sound wave file would slip right by anti-virus software.

To be sure, there are a number of issues that need to be worked out...not the least of which is getting the commands to play when you are not at your computer to stop the process. But do not worry...it will not be long, before the bad guys figure out a way to do so...

One example...taken from the MySpace model...would be to play a typical wave file that has music for the first few minutes and then silence for 40 or 50 minutes, at which time the audio commands would begin to play.

Guess this could mean the end of the "open mike."

Another link related to this topic.

Chalmer

Hash SHA-1 compromised...

This isn't really new news, but the hash SHA-1 (Secure Hash Algorithm-1) has been significantly compromised! So...what does that mean to you?

Hashes are a list of characters that "represent" the contents of a message or file and are intended to represent those contents uniquely. Hashes are expected to have two important properties:

• If I have a hash value, I can't recreate the message or file in a reasonable amount of time
• I should not be able to find two different files that create the same hash value

For example, take the word "HASH". If I use the following values for the letters in HASH

H=1.1
A=3.1
S=4.1

I can use a special formula to create a value that represents the word "HASH".

For example, my (totally fictitious) formula might be:

• sum of the (locations X values)

Where I multiply a number that stands for the location of the letter within the word by the value of the letter and then take the sum of the results.

• the first H is the first letter and has a value of 1.1 => 1 X 1.1 = 1.1
• A is the second letter and has a value of 3.1 => 2 X 3.1 = 6.2
• S is the third letter and has a value of 4.1 => 3 X 4.1 = 12.3
• the last H is the fourth letter and has a value of 1.1 => 4 X 1.1 = 4.4

Adding all of these up gives me 24.0.

The letters SAHH would give me a value of

• the first S is the first letter and has a value of 4.1 => 1 X 4.1 = 4.1
• A is the second letter and has a value of 3.1 => 2 X 3.1 = 6.2
• H is the third letter and has a value of 1.1 => 3 X 1.1 = 3.3
• the last H is the fourth letter and has a value of 1.1 => 4 X 1.1 = 4.4

Adding all of these gives me...18.0, even though the letters in the word are the same...thus we can calculate the hash value and prove that the words are different.

Why is this important? A workable hashing algorithm can help prove that something has not changed since it was created. For example:

• You send a contract to a client and they alter it slightly...something subtle that you wouldn't notice right away...compare the hash value of the two files and you can prove they altered it.
• Many popular files are hosted on multiple sites (called mirrors), but those sites may not be controlled by the author of the file. Once you download the file, you can take the hash value and compare it to the hash value posted by the author - if they don't match, you can tell you have a file that was corrupted during the download or worse yet, has been tampered with by the bad guys.
• Monitoring software on your computer can use hashes to tell that a virus or trojan has altered your files or programs, by periodically checking your current files against baseline values it keeps in a database. Any change to your program results in a different hash and your monitoring software can alert you to the change.

Now that SHA-1 has been compromised, there is the threat (albeit, very remote) that someone can create two different files that have the same value. The computing power and time necessary to do this are outside the realm of normal folks, so no need to panic yet. The folks at the National Institute of Standards and Technology (NIST) are working on creating a new hashing algorithm and should have one in about 3 years.

The take home message:

• don't panic yet
• look for hash values when you download files (especially from mirror sites)
  
• compare the hash value of the file to the author's hash value
• keep your eyes out for future versions of hash algorithms

For more info on hashes, see these articles/sites:

1. Software to calculate hashes: HashCalc
2. Example of a site that lists hash values of their software (the SHA-1 values are listed before each of the "filenames" that end in .iso)
3. More details on hashes by Bruce Schneier
4. NIST's write-up on SHA-1

Chalmer

Passwords, Part 1

Trust me...I don't like them either: passwords (a.k.a. PINs, passphrases). Passwords are synonymous with the computing experience, but few people appreciate the heavy lifting that these words and numbers perform. Due to poor security, passwords are often the only line of defense between you and the enemy, so make sure your passwords are good, strong passwords.

A strong password has the following characteristics:

• Length: the longer your password, generally the better. Eight characters* or more is generally considered the minimum.


• Variety: use the weird characters on your keyboard (i.e. $5?:!}+*3). The only real reason keyboard makers put those characters on there, is so that we can have better passwords. You paid for the extra keys, go ahead and use them!


• Early Death: euthanize your passwords regularly. If the bad guy gets a password, you can give him a rude awakening when the password stops working. 30 to 90 days is a good maximum lifespan* for a healthy password.


• Secrecy: Stop taping your password to your monitor. Stop giving your password to your friends. Passwords like their privacy too.


• Seldom Used: Don't make your poor password slave away all the time. Pick different passwords for each application and each website. This goes hand-in-hand with the secrecy issue. Why give your bank password to the staff at Blockbuster Online?

* since this is being written in Dec 2006, the guidelines on length and lifespan may change as computers get faster.

In a future post, I will help you figure out how to remember all of these long, complicated, obnoxious passwords.

Chalmer

Security in the real world

One key focus of this blog will be security in the real world. How to implement security in a realistic and effective manner. One of the major problems with security today is the inappropriate knee-jerk reaction to security vulnerabilities. We find that security responses often:

• respond to the wrong threat
• respond in a way that is ineffective
• respond in a way that feels good, without providing a valid return on your security investment

We intend to address how to overcome the knee-jerk reaction and engineer security that actually works.

Chalmer