The next world war?

This article by Jim Melnick in the Boston Globe covers some of the salient points associated with cyberwarfare...

It is only a matter of time before the United States and other world powers begin to see the onslaught of calibrated and calculated attacks, in much the same manner as was demonstrated in Estonia.

To quote Mr. Melnick: "Though many US websites are well-protected, a massive denial of service attack could leave many commercial and other sites reeling along the lines of what occurred in Estonia, but on a larger scale. Given that more of our daily lives today depends on the Internet, financial losses could be huge and would be accompanied by a corresponding loss of consumer confidence."

The article also covers some of the issues associated with attacks on infrastructure and military and governmental institutions...

"For 10 years, the federal government's information systems and critical infrastructures have remained a "high-risk" category as assessed by the Government Accountability Office."

The worst part of the equation...as it is in so many things related to security - we have to be successful in defending ourselves 100% of the time and they (the bad guys) only have to be successful once.

Chalmer

Trojan software hidden on Job Search web-sites...

Very nice article by Brian Prince on a Trojan malware that has infected a number of web sites, allegedly including Monster.com and other job search web sites.

Some quotes from Brian:

"The hackers behind the attack are running ads on the sites and injecting those ads with the Trojan. When an user views or clicks on one of the malicious ads, their PC is infected..."

Moral of the story: Even reliable, trusted sites can inadvertantly host malicious material or host links to sites that do.

"...all the information entered into their browser, such as financial information entered before it reaches SSL protected sites, is captured and sent off to the hacker's server..."

Moral of the story: one of the best ways to get encrypted data is to get it before it gets encrypted...

Brian quotes Don Jackson of SecureWorks: "This Trojan uses its own packer…it compresses and changes the code around," he said. "This packer is unique to this Trojan. It was written specifically for it, and the construction kit that produces the executables is very, very good at putting instruction substitutions, giving a long string of instructions for a simple task and putting garbage code or null operations in there, so that it is hard for anti-virus. Anti-virus has not been able to pick a stub…that they can identify reliably from file to file."

No moral here...just fascinating how well the creators have considered the issue of camouflaging their presence.

Chalmer

Forensics on a hacked Linux box...

The Holliday cracking article (sic) shows how one guy walked through doing forensics on a box. The interesting part of this discussion is two-fold...

first - seeing what the cracker/hacker did to the Linux box
second - seeing the range of comments on Bruce Schneier's website about how the "forensics analyst" went about his analysis - i.e. what to do, what not to do

The take home message for this:

* No computer is truly safe
* When doing forensics, the techniques you use and the decisions you make are gonna be second guessed endlessly.

Chalmer

Digital Armaments and cash for vulnerabilities...

I came across this web-site for Digital Armaments. These folks pay researchers for vulnerabilities. Find a problem, tell them about it and they give you compensation (and your name in lights, when they forward the information on to interested parties).

Capitalism at its best...get someone to do your work for you dirt cheap, and sell the results for as much as the market will bear. I applaud them for their ingenuity.

I am not sure of the inner workings of the company (i.e. who they sell their products to...what they do with the vulnerabilities...) therefore I can't comment on whether this firm's actions are good or bad - but the business model is certainly interesting.

Chalmer

Sourcefire and Nmap team up...

Sourcefire (the owners of Snort) and Insecure.org (the maker of Nmap) are teaming up to improve the abilities of Nmap to pinpoint vulnerabilities. Take a look at the article for more details...

If you haven't tried Snort yet or Nmap...give them a whirl...

Chalmer.

Linux Command Directory

This website is a great resource for insight on Linux Commands. It comes from the book Linux in a Nutshell by O'Reilly.

Chalmer

Been a long time...

It has been quite a while since my last post. My time was fully committed to the task of searching for a new job. Which I found...

I am now working for a consulting firm in Maryland, doing information assurance/information security work.

This will enable me the opportunity to really focus my studies on InfoSec and hopefully pass some of that info on to you, my astute readers.

Chalmer

There is an interesting post on one of the many Google Blogs on how to search specific sites for data. In researching information security topics, it is often frustrating to use the default search box on certain websites. Many websites don't have decent indexing of their data and thus don't/can't offer effective search tools. Google has a way to overcome some of these limitations...

For example:

site:www.example.com sample

Would search the site www.example.com for the term "sample". Similarly,

site:insecure.org hacker

Will search the website insecure.org for the term "hacker".

Happy searching...

Chalmer

Only one main interface to the Internet???

Very interesting article about a potential plot to disrupt Britain's Internet access...One item that jumps out at me:

Raids by Metropolitan Police detectives found computer files indicating that terrorist suspects had targeted a high-security Internet "hub" in London that handles most of the Internet information that passes in and out of Britain, including London's businesses and stock exchange, the Sunday Times said.

The first question that comes to mind...is "Why does Britain have only one main hub to handle the majority of their Internet traffic?

This flies against the security principle of redundant systems.

Chalmer