AuthenticationWorld Blog

Joanna Rutkowska supposedly demonstrated yesterday at the Black Hat conference in Washington DC a way to defeat malware detectors who are looking for rootkit attacks. According to a story in Dark Reading " How to Cheat Hardware Memory Access" Joanna says ""I believe that this is going to be the first public presentation of how malware can cheat hardware-based memory acquisition" "

The article goes on to state:
"Researchers and forensics investigators today rely more on reading hardware-based memory to get an accurate picture of the OS to help detect malware, mainly because it's difficult to find rootkits in today's complex operating systems."

""All rootkit detectors on the market today can be seen as more or less random 'hacks' that check only some limited number of well-known places in the OS," Rutkowska says."

"Plus if the system has already been compromised, you can't trust any programs executing on it -- not even the rootkit detector program itself, she says. So hardware-based memory access has emerged as the best way to get a real look at what's going on."

Joanna is the same person who last year presented the Blue Pill attack, using virtual memory. She has also recently been discussion her concerns re Vista's UAC.

Bottom line: The attacks get cleverer and cleverer and the tools to respond to these attacks are far behind. Have layers of strong authentication in your enterprise to mitigate the risk. Use transaction authentication around your crown jewels. Then have filters on everything digitally leaving the enterprise to catch precious information that has evaded all the other defense layers.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

The BBC this week ran a story "Which? highlights phishing losses" that documents the rising increase in the number of phishing attacks against UK financial institutions. The story says "Phishing frauds against UK banks have shot up from 40 to 1,000 a month in the past two years, say banking experts.".

The story then goes on to state that the UK consumer group "Which?" is calling on banks to give automatic compensation to phishing victims. The story states:

"A spokeswoman for the banking organisation Apacs said while this was true, there were no plans to change policies soon."

""The banks have all said they may do so in the future, because it (giving away confidential details) is like giving away your door keys," she said."

""But at the moment there are no current plans."'

"She explained that banks were not planning to punish innocent victims of online fraud, but in some cases might refuse to compensate someone who had suffered losses more than once, on the grounds that their negligence was a contributory factor. "

Finally, the story ends with "The banking industry estimates that £22m was lost to phishing frauds in the first half of 2006."

Bottom line: Think on it before you click on any link in an email message. If you don't, your identity and authentication information may be stolen and you may incurr a loss which you bank may or may not cover.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

A great article appeared today in eWeek "Black Hat Demonstrations Shatter Hardware Hacking Myths". It discusses two presentations this week at the Black Hat Conference in Washington DC that destroy some common beliefs about detecting and removing rootkits.

The article states: "
One shocker was Coseinc Senior Security Researcher Joanna Rutkowska's demonstration of a way to subvert system memory through software—in essence, the shattering of our long-held belief that "going to hardware" to secure incident response is a security failsafe.

Security professionals at the show called it the "attainment of the holy grail," particularly since the only way to fix the system's memory corruption is to reboot—thus erasing all tracks of the subversion.

It's a digital forensic team's worst nightmare. How can you figure out—and prove in court or to auditors—what people have been doing on your company's PCs, for good or evil? "

It then goes on to talk about the other presentation by John Heasman from NGSS (Next Generation Security Software) . The article states: "

Heasman chose to persist a rootkit on a PCI device containing a flashable expansion ROM. At the present time, how to detect and prevent such an attack isn't understood when the system in question doesn't contain a TPM (Trusted Platform Module).

"My thinking is if you can get a rootkit into an environment where they reimage the system daily, as in some secure systems, we could still survive," Heasman said in an interview with eWEEK. "There are no tools in pub domain that would detect that."

Heasman went on to demonstrate the abuse of PXE, the Preboot Environment developed by Intel as part of is "Wired for Management" initiative.
"

Both of these presentations together combine to present very serious challenges to enterprises in first of all detecting rootkit attacks and then getting rid of them. I am wondering (and this is just me dreaming out loud) if this is why the US Department of Commerce physically replaced over a hundred computers after being successfully attacked last year? Perhaps the US government already realized that re-imaging the disks wouldn't necessarily guarantee the elimination of the malware.

Stay tuned for more discussion on this topic.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Reports are starting to appear indicating the Vista's activation program can be relatively easily hacked by a brute force attack. An article today in the Inquirer "Vista activation cracked by brute force" quotes Keznews which contains software and step by step instructions on how to conduct the attack. Keznews states the attack can take hours or days to be accomplished using only one PC.(on the main page a user states they got three keys in five hours). If you were to apply a cluster of PC's then the time becomes easily handled by criminals.

If this report is confirmed, it puts a very dark eye on Vista.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

The Honeynet Project and Research Alliance early last month published a very interesting report "Know your Enemy: Web Application Threats". The report states: "

By their nature, web applications are often widely accessible to the Internet as a whole meaning a very large number of potential attackers. All these factors have caused web applications to become a very attractive target for attackers and the emergence of new attacks. This KYE paper focuses on application threats against common web applications. After reviewing the fundamentals of a typical attack, we will go on to describe the trends we have observed and to describe the research methods that we currently use to observe and monitor these threats. "

This is definitely a report worth reading. The report covers all sorts of common attacks against web servers including code injection, remote-code inclusion, SQL injections, Cross-site scripting, IP based scanning, spider based attacks, top 10 operating system commands targeted, email spam, blog comment spam, defacements, hosting files, scanning tools used, botnet recruitment, phishing and trends in evasion and anonymity including proxy servers, goolge translate, onion routing and script encoding.

The reports recommendations on how to protect web servers are worth noting: "

Web servers can be protected from threats in many ways. Firstly, we recommend that the administrator keeps an inventory of what applications are on the web server and maintains patch levels for all of them. A host-based Intrusion Detection System, such as mod_security for the Apache web server may be used to block certain common attack vectors, such as "wget" and "curl" appearing in GET and POST requests. This will not provide complete protection from remote code inclusion attacks in particular, but will block many common attacks. If the attacker can include arbitrary code in the running application, they will be able to evade most keyword filters. Alternatively, an application proxy can be deployed in front of the web server to filter out these types of malicious requests. A Host Intrusion Detection System (HIDS) program such as Tripwire may be used to monitor the integrity of critical system files.

Correct configuration of web servers such as Apache and scripting languages such as PHP is also crucial. We mentioned register_globals earlier which allows an attacker to set variables which can cause problems if the developer has not specifically initialized them. The allow_url_fopen configuration directive should be disabled if possible as this prevents remote code-inclusion attacks. The Open Web Application Security Project provides further details on securing web servers and applications.

Programmers can create more secure applications by rigorously validating all input they receive. Where 'include' statements exist in PHP there should be no way for an attacker to control the name of the file being included. If input is going to be echoed back to the user, the application must take care that Cross-site scripting (XSS) attacks cannot occur. The typical example is to disallow or escape '<' and '>' characters to prevent the attacker from entering javascript code. Ideally SQL operations should be in the form of prepared statements so that data is treated purely as data and does not have the chance to become code, as it does in an SQL injection exploit. A full treatment of this subject is beyond the scope of this article but a good reference for PHP developers is "Essential PHP Security" by Chris Shiflett and published by O'Reilly press. There is also a good set of recommendations for programmers and system administrators as part of the SANS top 20 vulnerabilities, in section C1.3. These include making use of the Hardened-PHP Project's Suhosin tool to control the execution of PHP scripts, migrating to the latest version of PHP and making use of the PHP Data Objects extension when performing SQL queries.

We also recommend that a Network Intrusion Detection System is used which should alert the administrator to events such as connections from web servers to an IRC channel outside the organisation, the port-scanning activity that will be associated with some of the worms and scanning tools, and possibly the increase in traffic that may occur if the server is sending spam email or hosting a phishing web site. Lastly, the administrators should be responsive to the postmaster and abuse email addresses at their domain, which often provide rapid warning of incidents in progress.
"

Taken all together, this is a fine piece of work and is definitely worth a read. As always, I close by noting that all enterprises should understand the numerous attack vectors open to criminals in attacking your enterprise. The reality is that some of these attacks will be successful despite your best efforts. Therefore, put in a many layered defense system using strong authentication, transaction authentication and filters on digital data leaving the enterprise to catch thieves walking out the electronic front door with your crown jewels.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Yesterday, Ryan Naraine blogged about Apple's latest Quicktime patch update and recommended all users update. The reason why is there are several holes in Quicktime, affecting both Mac and Window users that could allow hackers/criminals to take over your computer. Some of the attacks documented can result in malware being deposited which can then capture your identity and authentication information.

Read his blog for more information and ensure you have the most recent patch available from their download site.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Well, there is some doubt that the attack against Vista works. Computerworld's "Vista activation crack a 'joke,' says hacker" states that the hacker has said it was all a joke. However, some people are claiming that it does work and that the hacker is under pressure of criminal charges or litigation from Microsoft.

I am speculating that the hack does work, but albeit slowly if using one computer. I am also speculating that organized crime may use this hack in conjunction with clusters of servers to come up with activation codes that Vista/Microsoft will accept. This is pure speculation on my part. However, I believe that there is some financial gain to be had for criminals if they can quickly brute force the activation codes and thus avoid licensing costs for Vista.

Time will tell if my speculation is wrong or, if there is something here.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

eWeek today ran a story "What's Bugging eBay?" that is worth reading. The article documents the increasing number of sophisticated phishing attacks from "Vladuz, the Romanian impaler".

The article quotes "The eBay villagers are whispering that he can creep through eBay's internal databases and suck the lifeblood of customer accounts—log-ins and passwords—right out of their pulsing, 222 million-plus customer heart. He's putting up bogus listings as fast as eBay can take them down, and that proves he's walked through a security hole as big as a barn door."

Ebay in response, is quoted in the article "No, eBay insists, this hacker, this Romanian wiseguy who goes by the handle Vladuz, is "nothing new." He's just another phisher, says eBay spokeswoman Catherine England, one of hundreds the huge auction site has to deal with constantly."

The article then goes on to quote other sources claiming that eBay is downplaying the situation and the the criminal is making significant intrusions into eBay.

Stay tuned for more on this. As alway, protect your authentication information by thinking on it before you click on any link in any email.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Adam Laurie out of the UK, is yesterday reported by Computerworld as having cracked the RFID chip contained in new UK Passports. The story "Crack! Security expert hacks RFID in UK passport" documents how using a brute force technique with information gleaned about the user from the internet, Adam was able to crack the code with his program after 40,000 attempts.

While this may seem like a lot of attempts, computers are able to deliver thousands or tens of thousands of attempts per minute or even more. Therefore, the program is very quick.

Adam didn't even take the passport out of the wrapper it was delivered in.

The story quotes the British Government as responding:
""The key point ... is that the information on the chip cannot by changed, rendering the procedure described by Adam Laurie pretty pointless," wrote Peter Wilson, senior press officer, in an e-mail."

"Further, a cloned chip would have to be inserted into a forged passport, and new security measures in the passports make that "virtually impossible," the Home Office said, quoting a report released last month by the National Audit Office."

To which the story then quotes Adam "But Laurie said the new passports were marketed as enhancing security, "but so far I don't see anything about it that increases my security.""

"The greatest weakness with the passports is using relatively easy-to-find data to compose the encrypted key, Laurie said. It would be better to include more random elements that would render brute-force style programs nearly useless, he said."

Bottom line: RFID is breakable depending on the encryption scheme used. In this case, the encryption algorithm user key was poorly designed and open to brute force attacks.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Bloomberg today ran a story "Crime Ring Used TD Ameritrade, Schwab in Online Fraud " which outlined how criminals netted over $700,000 from the use of phishing and malware to capture users brokerage account uid's and authentication passwords.

I suspect this story is just the tip of the iceberg. In December there were over 28,000 phishing sites. Vinton Cerf, one of the original internet creators, recently stated that one quarter of all internet computers (150 million out of 600 million) are being contaminated with malware and are acting as bots. Therefore, the likely impact of crime is probably at least a couple of orders of magnitude greater than the amount discussed in this story.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Searchsecurity.com today has an interesting article "Dynamic code obfuscation: New threat requires innovative defenses". The article lays out the changing face of malware and the threat to enterprises.

As the article states, code is often intentionally obfuscated to prevent reverse engineering. Hackers in the past have adopted this as well. Malware detectors responded by using code signatures to detect the obfuscated code which has already been recognized. However, as the article points out, the game has gone up a notch with dynamic code obfuscation.

Today, viruses are created that are unique for every computer it infects. This effectively kills traditional malware detection approaches using signatures since every attack is now unique. It requires anti-virus vendors to instead adopt heuristic responses.

The challenge with adopting this technique is that it's very processor intensive. As the article points out, it likely means placing this technology at the enterprise gateways.

My point is that all this technology is pretty new and that in some or many cases, it is insufficient to prevent malware attacks. The advantage is currently with the criminals until we have widespread adoption of new detection techniques. This means that it is likely your outer perimeter will be successfully breached. Have in place layers of additional identity authentication security behind the firewall to mitigate the risk.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

There is a very interesting story in a UnixAdminTalk discussion group that talks about the entire Quebec Healthcare system becoming infected with a virus. The virus had a denial of service attack component that effectively killed several hospital network connectivity. The blog says that some hospitals were down for three days and reverted to paper to order tests etc.

Now if there ever was a case for having layered authentication security strategy, I'd say this was it. They didn't and the result was a provincial crisis.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Brain Krebb's today has a blog that outlines a smart vishing attack on Bank of America customers. The customers receive an email notifying them that they are in violation of the bank's acceptable use policy. They then give the customer a 1-800 number to dial. In this case, the message was done very well. It asked for the customer's PIN in order to validate their identity. After that, the criminal has the information to begin drawing down from the account.

Don't respond to these emails and use the phone number provided!!!! If you are concerned, look up the bank's phone number in a telephone directory or via the internet and call them up directly to talk about the email and your account. If you don't then your identity and authentication information are in the hands of criminals.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Two days ago, Symantec reported a possible new hole in Word. Yesterday, US-CERT issued a vulnerability note confirming the problem. Today, Computerworld ran an article "Beware Word docs: New bug crashes Windows XP, 2000" that confirms all the above. The hole causes Microsoft Explorer to crash making Windows unusable.

As always, think on a document attached to an email before you click on it. Otherwise, the document may have malware within it, causing you to lose identity authentication information such as your uid and passwords. Always beware of Office documents since for much of the time, there are often unpatched security holes.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Yesterday, Network World published an article "ID theft forecast: Gloomy today, worse tomorrow". In it, the article quoted Avivah Litan, a Gartner analyst as saying the following:

* "For the year-long period that ended last August, 15 million people were burned by some kind of fraud related to identity theft"

* "That number is 50% higher than 2003 data released by the Federal Trade Commission"

* "The average identity theft fraud loss more than doubled in 2006 to $3,257 from $1,408 the year before"

* "The percentage of recovered funds dropped to 61 percent in 2006 from 87% in 2005"

* "The average loss on new-account fraud -- where criminals use the data they've stolen to open new credit card or bank accounts -- was $5,962 in 2006, a jump of 223% over 2005's $2,678."

* "...unauthorized charges to credit cards leaped nearly fourfold, to an average last year of $2,550. Unauthorized charges in 2005 averaged just $734."

Further on in the article it states ""But I really think that it will take an extreme attack of some kind and broad disruption before things change," Litan said."

This just confirms what other experts and myself have been saying i.e. there's at least two to three years of more bad news ahead before things start to get better.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

The evidence continues to mount that the upper hand in the arms race between anti-virus vendors and criminals rests with criminals. Today, Brian Krebb's bloged about "Online Anti-Virus Scans: A Free Second Opinion". In the blog he referenced several sites showing that anti-virus tools frequently miss new virus variants (here and here).

If you drill down into the data in the AV Comparitives Report published February 6, 2007, you will see that most vendors have trouble detecting Backdoors, Trojans and other malware detection. Kapersky did well in this test at over 99%. However even with this rate, it means that it's missing one in a hundred. The rest of the vendors fall off the wagon with results ranging from approximately 96% to 51%. Other studies I have blogged about, show the rate to be much worse.

What this means is that some malware is going to get through your anti-virus defenses. The question is, what are you going to do about it?

If you are smart, you will have some heuristic intrusion detection system running to pick up some of the malware based on the way systems and applications operate. However, these may or may not pick up programs that trap user's uid and passwords and pass out the electronic door to criminals.

So then what? The only answer is to have layers of stronger and stronger authentication as the user accesses higher risk applications. However, once again, these too may be foiled. Therefore, you need to have transaction authentication protecting your enterprise crown jewels.

The last line of defense must be filters on everything leaving the enterprise electronically which are looking for high risk data and information.

Without this, your enterprise is at medium to high risk of being successfully breached. The worst part is, you might not know of it until several months or years later.

An alternative to the above strategy is to change your mindset at the firewall and deny all except those with permissions. This however, requires a big change in user behavior since it will restrict much of what they can do. More about this in the next blog.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

The BBC ran an interesting story today "Staying safe without anti-virus". It covers, at a high level, the elimination of the use of anti-virus software. Essentially, the article covers what I call "Deny All Except With Permission". This is an area where I believe more and more enterprises will move to over the next two to three years. Why?

Most experts agree that currently the upper hand is with criminals in the malware arms race. The existing protection technology can't keep up the many different attack vectors open to criminals. The result is that while many enterprises will adopt heuristic response detection systems, these too will never be 100% effective. As a result, the press will be full of bad news stories over the coming two years. They will document the damage and there will be a lot of hand wringing going on.

An alternative is to change the way enterprises currently work at the firewall. Today, most enterprises allow all traffic to pass through except for traffic that is on a bad list. The reasons for this are performance and user ease of use. Security is this reduced.

By switching over to deny all except with permission, the rules of the game can be tilted in favor of the enterprise and away from criminals. Only those processes you want to run will be allowed in through the firewall while everything else will be denied. This can effectively significantly reduce the exposure to existing malware.

However, this in not a panacea. The result is performance restrictions at the firewall. Further, users may not be able to have as much freedom.

I might take issue with the one man IT shop guy quoted in the BBC article on his total plan. He is still being exposed to employee actions on the internet. Getting rid of anti-virus is okay but there also needs to be intrusion detection systems behind the firewall. They need to mitigate the risk of data leaving the enterprise from things like criminals obtaining user uids and passwords through things like social engineering attacks, hardware keyboard loggers and software keyboard loggers. Further, there also needs to be detection on all traffic leaving the enterprise to prevent sensitive data from leaving the enterprise when a security breach has been successful.

Bottom line? Moving to deny all, except with permission is going to become more popular over the next two to three years. However, it too is not perfect. Always have a layered security defense system in place using stronger authentication, transaction authentication and filtering of all traffic leaving the enterprise.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Yesterday, eWeek ran a article "Trojan Targeting eBay Motor Buyers" that indicates the growing sophistication of phishing attacks. The article documents how a new phishing attack against eBay car buyers works.

The user receives an email. In the email are pictures of cars for sale off the eBay website. The user then clicks on a attachment in the email. Malware is downloaded. The user then sees what looks to be the eBay site. They fill in the information and pay their money. However, the site is false and the money goes to the criminals.

Don't click on any link or attachment in an email unless you are expecting it. Otherwise, malware will likely be deposited on your computer, your uid and authentication information stolen and your money may also go along to the criminals.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

There was a very interesting article on Friday in Dark Reading "DNS Attack: Possible Botnet Sales Pitch". The article discusses reasons for the February denial of service attack that temporarily crippled two of the internet's 13 Domain Name System Root Servers. One of the reasons being hypothesized was that this was a "sales pitch" to demonstrate the strength of a botnet.

The article goes on to describe the attack. What I found interesting was the conclusion of the article:

"To help mitigate future attacks, ICANN recommended last year -- and reiterated in the paper -- that DNS server operators verify source IP addresses, and that ISPs should only accept DNS queries from "trusted sources (i.e. their own customers)." ICANN acknowledged that the recommendations had been "met with mixed success.""

"In addition, ICANN called for educating consumers on botnet infection, and ensuring that consumers change their home router's default passwords."

"But whether the recommendations for thwarting future DNS infrastructure attacks will fall on deaf ears is unclear. "Getting ISPs to implement source filtering and turning of open-recursive lookups has been an ongoing battle for many years -- and one with only limited success," says Craig Labovitz, director of engineering at Arbor Networks. "And while reflective attacks provide an easy way for zombies to attack [and] multiply firepower, it is not clear reflection played a significant role in the most recent attacks." "

A huge problem exists with the existing DNS infrastructure. I have blogged repeatedly about DNS threats. In my mind, the threat from a large scale internet shutdown still exists. However, why would any criminal want to do this? The answer is not likely from a criminal gang since the shutdown of the internet would draw intense investigation. However, I can definitely see a country wanting to shut down the western economies and cause economic and political damage who might do this.

Meanwhile, back at the enterprise level, the threat of DNS attacks exists and can be very high. Work with your ISP to ensure that this type of attack won't cripple your business.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Last week Dark Side's Site Editor, Tim Wilson, wrote a blog "Firewalled - One Bite Is Not Enough" that made me very depressed. Attending last week's Visa Security Summit, he describes the current law enforcement attempts to catch the bad guys. What he wrote, while I know all this, depresses me to read.

Here are some article quotes that should make you depressed too:

"..that U.S. law enforcement agencies seldom attack computer crime in any sort of coordinated, nationwide fashion. Almost everything is still being done regionally."

"Internationally, the problem appears to be even worse. During the presentation, a discussion of the prosecution of international computer criminals quickly devolved into an explanation of jurisdictions and extradition treaties. One of the speakers essentially said that Interpol, the organization that's supposed to be coordinating cross-border crime investigations, is all talk and no action."

"All four of the speakers conceded that they investigate only a fraction of the cases that are reported, because only that fraction has a chance to result in arrest and conviction. If it's unlikely that the cops can find the criminal -- or if they anticipate having trouble prosecuting the case -- they simply don't even look into it. "We just don't have the resources," two of the speakers said."

"So the average Russian spammer today is sitting pretty. Even if U.S. or U.K. officials could find him, which is no easy task, they probably wouldn't have the resources to pursue an arrest. And even if they did find him and arrest him, they might not be able to extradite him -- or they might not be able to build a case that resulted in a prosecution in another country's courtroom."

"When we polled black hats about their attitudes last month, fewer than 3 percent of respondents said they worry about getting caught and ending up in jail. Four percent said they worry they might get caught, but they doubt they could be convicted. Five percent said they know getting caught is a possibility, but they don't worry about it."

"...it appears that today's computer cops are more bark than bite."

Bottom line: Don't expect law enforcement officials to protect your enterprise. Absolutely make sure you have a layered identity authentication defense in place.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Eweek is reporting today of an event last week in Italy which reportedly saw Window's Live being taken over by criminals. As a result, whenever an Italian user input a popular search term, the website they were directed to was a fake website that contained malware. Oftentimes, the article reported that fake pop-up boxes and pages with false Window's error messages were displayed requesting that the user to install something. What the users didn't know was that was was being installed was malware.

This kind of attack is extremely hard to prevent from the user's perspective since they are trusting the integrity of the search engine. When the search engine has been compromised, the user is in severe danger of an attack.

Make sure that your users think on a link before clicking on it.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Ryan Naraine had an excellent blog today "Apple bumper patch vindicates MOAB, MOKB hackers" on the recent massive security patch addressing 45 security holes issued by Apple. In it he documents the recent fixes due, in part, to the recent "Month of Apple Bugs" and the earlier "Month of Kernel Bug" projects. As he points out, some of the holes were high risk.

More importantly, he highlights management tasks that Apple has to do in order to put its own house in order re security. While Apple is currently running all sorts of ads and promotional material highlighting why the Mac Os is more safe than Windows, the truth it it hasn't been as severely tested by hackers and criminals as has Windows.

Read his blog since his recommendations are excellent.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Brian Krebb's of the Washington Post today wrote an interesting article "Cyber-Criminals and Their Tools Getting Bolder, More Sophisticated". In it, he documents the case of one man who had his bank information stolen. However, when the man received a new bank id and password this too was stolen by the same software that stole his original passwords but this time it also took his Social Security Number and online shopping data as well.

Towards the end of the article, Brian outlines how law enforcement agencies are overwhelmed by the amount of identity theft data they come across. The article quotes make for some nervous reading:

""We're just getting overwhelmed with this [compromised] consumer data, but it's not exactly law enforcement's job to call each victim and explain the situation," said Dan Larkin, an FBI agent who heads the National Cyber-Forensics & Training Alliance in Pittsburgh."

"Credit bureaus are not required to notify consumers."

""The credit bureaus work on behalf of banks and companies that grant credit," said Ari Schwartz of the Center for Democracy and Technology, a consumer advocacy group in Washington. "They're not set up to be consumer-oriented businesses.""

"And the credit bureaus say they are not in the habit of reaching out to consumers whose private information may have been compromised."

""Normally we would not put a fraud alert on a file without a consumer being involved" or initiating it, said Maxine Sweet, a vice president with Experian, one of the three major credit-reporting bureaus. "That's just not something we generally do.""

In the US then, a consumer may have their identity information stolen. The police may come across this. However, the consumer may not know that their identity data is stolen. Worse, a credit agency might but also not notify the consumer. It's only when the consumer goes to apply for more credit that they would realize their identity information was stolen.

In other words, their is no one in the US out notifying the consumer that their identity information has been stolen! That's what I call bad.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Brian Krebb's the Washington Post today wrote a blog "Tracking the password thieves" documenting how he had backtracked a malware virus and found out that it had infected 3,221 victims in all 50 US states. The blog documents several very interesting points:

1. The virus contains a "geo-IP". This is the estimated latitude and longitude for the user. Why this in a virus? Financial institutions now are more frequently using "transaction authentication" software when you do a financial transaction. So, even though you've logged on successfully, the transaction authentication software will see what geo-location you're coming in from. So, if you're in Kansas and the identity making the withdrawl is in Russia, the transaction authentication software might refuse the transaction and notify the bank. Therefore, criminals are getting smarter. They now try and figure out where your identity lives and then have someone make the electronic transaction in the geo-location where you live.

2. Many of the victims, when contacted were keeping their computers up to date with anti-virus and Window's patch updates. What they didn't realize is that the virus had turned off the anti-virus software.

3. Many of the victims thought the anti-virus software would catch all the viruses. Brian found out that three free anti-virus tools a week later still didn't think the virus was malicious.

4. Most of these victims had clicked on an email link or document attachment to start the virus. My advice is to "think before you click on it". Don't click on any email link or document attachment unless you are expecting it.

5. Many of the victims were well computer educated people. Some were working for large companies who's internal computers were affected by the attack.

Bottom line: There are likely millions of people and thousands of enterprises who are infected and don't know it. Therefore, from an enterprise perspective, have a layered authentication strength defense to mitigate the risks.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Many enterprise managers think that phishing attacks against their enterprise is low risk because they're not a financial institution. They're wrong in that assumption as the ComputerWorld article yesterday "Fish for new employees and get phished?" points out.

The article quotes a manager at a midwest US engineering services company. He has found that his company has had several phishing attacks using CareerBuilder.com. Here's how the phishing attack works:

The engineering enterprise receives an email purportedly from someone who has a job applicant. The manager must click on a link to take them to the resume (in this case from CareerBuilder.com). When the manager clicks on the link, they are taken to a false CareerBuilder.com website. There the manager will view the phony applicant's resume. Meanwhile, malware containing a Trojan is downloaded into the manager's computer.

So, you don't have to be a financial institution to fall victim to a phishing attack. Beware!

Have in place a layered authentication defense strategy to mitigate the risks of a successful attack. Meanwhile, educate your employees to not click on email links or document attachments.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Yesterday ComputerWorld ran a story "How to run Vista legally without activation ... for at least a year" that outlines how in the business versions of Vista it is possible to continually avoid having to register and activate the product for up to a year. While Microsoft is arguing that this is a "hack" others are documenting it as a legitimate "feature".

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Computerworld yesterday published an article "CEBIT: Malware to fight crime? AV companies say no" that documents attempts by government police agencies to adopt malware practices to catch criminals. While this story is interesting, what came to my mind when reading it is that the FBI was in court several years ago over the use of keyboard loggers. Further, the use of malware by spy agencies has been known for a long time.

Protecting the rights of the citizen against the invasion from others must trump most cases except where national security can be documented and a court order imposed to allow the use of malware. Otherwise, police agencies shouldn't be allowed to use malware.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

eWeek yesterday ran a very interesting story "Can a Rootkit Be Certified for Vista?". The article spells out the existing security holes in Vista as well as noting the significant improvements. Here are the main points of the article:

* Vista can be easily hacked by inserting bugs on drivers
* Vista can approve programs that have malware by criminals paying $500 to have programs approved for Vista
* SQL Server 2005 was applauded for it's security progress
* UAC (user access control) was thought to be a general improvement
* However, UAC is easily breachable in several different ways
* Windows defender was a good improvement to detect and remove any unwanted application
* Vista's new firewall is also a good improvement
* Windows security center is a good improvement
* Vista's installation program is a problem in that it allows installers to run with administrative privileges having full access to the file system and registry and have the ability to load kernel drivers which could allow rootkits to be downloaded
* Vista uses BitLocker Drive Encryption that encrypts Windows volume, protecting against data theft but it's available in only the Enterprise and Ultimate versions of Vista and is lacking in the Business version.
* Vista uses encrypted file systems to encrypt files and folders and rights management services to to encrypt files and and prevent emailing of them outside of the enterprise without the appropriate rights permissions
* Device controller is used to to enable better management of plug and play devices
* Vista uses PatchGuard to lock down the kernel which was immediately cracked as Vista was released
* Window's Defenders is fairing pretty poorly in anti-malware tests

Read the article. It's a good overview of the true state of Vista.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Techworld.com today published an article "Google's blog software hijacked by scammers" that highlights a growing area of concern on the internet, the use of fake blogs to download malware. As the article says "According to Fortinet, Genuine-looking blogs on topics as wide-ranging as “Star Wars, school, furniture, Christmas, cars and girlfriends” are now being created to host a variety of script-initiated malware. It would be impossible for visitors to spot the danger of these sites, which now number in the hundreds, the company said. Although they look genuine, it appears that all the sites have been specially crafted to fool visitors."

""These are not legitimate blogs that were compromised. They appear to be deliberately set up to promote phishing, which is against our terms of service. We are investigating, and blogs found to include malicious code or promote phishing will be deleted," Google said in a statement to CNET."

Watch out which blogs you visit or you may find your identity and authentication information flowing out the digital front door into the hands of criminals.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com

Ryan Naraine published a fascinating blog on Wednesday "Russian (Gozi) Trojan powering massive ID-theft ring". It documents the surprising discovery by SecureWorks of a Russian Trojan that has been stealing significant amounts of identity theft (5,200 homes with 10,000 records). The data stolen was being offered online for over $2 million. Worse the anti-virus vendors didn't catch it for weeks and in some cases months.

Here is what the tojan was capable of doing according to Ryan: "
* Steals SSL data using advanced Winsock2 functionality
* Users state-of-the-art, modularized trojan code
* Launch attacks through Internet Explorer browser exploits
* Users customized server/database code to collect sensitive data
* Offers a customer interface for online purchases of stolen data
* Steals data primarily from infected home PCs
* Accounts at top financial, retail, health care, and government services affected
* The black market value of the stolen data is at least $2 million
"

While this attack was mostly against home users, I suspect many enterprises would also be vulnerable if they are mostly relying upon the anti-virus vendors.

Don't have one layer of defense in your enterprise. Have multiple layers including the use of stronger authentication and transaction authentication or you will be vulnerable to successful enterprise attacks.

Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com