Over the years, the case whether Skype is appropriate for the enterprise has regularly been brought up. I just read a news article talking about a recently released trojan that intercepts Skype voice conversations and is based on code that was developed 3 years ago.

From this first article, it sounds like the malware gets installed onto a target computer, and then records all voice communication that Skype attempts to make. It is unclear if this includes call information routed through a system designated as a supernode.

Regardless whether it does or not, keep in mind there are governments in this world that would outlaw Skype if there was no way to intercept those calls (even in 2006!). And they typically “allow” Skype. That alone should be enough to give you some clues…

This morning a 0day for Microsoft Windows 2000 IIS 5.0/6.0 FTP server was announced on Full-disclosure (and milw0rm). From the sounds of it, this may require a valid set of credentials and thus be more of a priv escalation than a remote r00t, but close enough to be a bit worried. (Do you trust your FTP outsid…err…users?)

I have a friend who has an old Windows 2000 FTP server he can’t take down and it open to the Internet (with valid login information). One way to initially minimize the risk on this vulnerability is to limit those who can connect through your border/perimeter/firewall to the FTP service to only those people who have a legitimate need. If you don’t have such information available, perhaps the log files will give an accurate history of valid users? If nothing else, this is better than nothing to go on, especially until more information on this vulnerability comes out.

Thankfully my friend does have a lengthy store of FTP logs, and this quick script I banged out will pull out unique IP addresses, quick and dirty-like. I basically search for lines in the logs that contain “PASS – 230” which is the code for an accepted password.

$alllogs = Get-ChildItem “C:\somepath\ftplogs”
$whitelist = @()

foreach ($logfile in $alllogs){
$logcontents = get-content “C:\somepath\ftplogs\$logfile”

foreach ($logline in $logcontents){
if ($logline.Contains(“PASS – 230”))
{$whitelist += $logline.Split(” “)[1]}
}
}
$whitelist | Sort-Object | Get-Unique

Via Bejtlich, for future reference here is the link to log and packet captures from the 2009 Inter-Service Academy Cyber Defense Competition. Check the paper at the top [pdf] for some information on the attacks.

I have a special place in my heart for quotes and zen/koan type stuffs. So I’ve saved reading shrdlu’s recent related post until a laid-back Friday, and I’m happy I did. These security koans are excellent!

I wanted to repost something I saw on LiquidMatrix that I think is easily missed amongst the other security headlines they post: How to Work a Crowd (~6 minute video).

Lord knows I’m not a socialite. I’m a happy introvert which causes me to be a bit quiet. You wouldn’t know that from how I might interact online, but online is vastly different…and I’ve been doing this online thing for 15+ years in various forms and commitments, so it’s pretty old hat for me. This video is actually a nice reminder that very simple things really do work. And knowing is half the battle…

So here are some more tips off the top of my head, not just me throwing them out to anyone reading, but thoughts to remind *myself* of things to continuously work on.

– Smile/eye contact. This is something I’ve particularly been working on recently.
I used to do this naturally as a kid, but having the last name “Dickey” and being a reserved, smarty nerd was complete invitation for the less pleasant treatments in public schools. That, along with puberty (yay!), and maybe some other personal tidbits in my nuture/nature changed my behavior and I tended to avoid and not smile as I grew up. I actually did actively want to stick to myself rather than invite conversation. So, smile, make and hold eye contact, and that is usually invitation to either smile back or break the ice. Besides, as an introvert, you can’t go wrong with this and you might be rewarded for it.

– Get someone talking about themselves and be truly interested.
Ever go on dates? The best dates come in two flavors (not counting scoring). First, fun dates where you just have a blast and have something to do that you both can enjoy, without being all that deep. Second, dates where you talk together and learn about each other (the ol’ dinner dates). Everyone has stories and loves to talk about themselves. The best dates occur when you talk only enough to keep the other person talking about their past/interests/self, and you listen properly attentively and take mental notes. There’s always time to share your own opinions and thoughts and stories later on (besides, why blow your mystery early on?!). (Having told my stories and opinions a multitude of times online and offline, you eventually get over that need to vomit them out immediately once a chance arises.) Simple conversation. No encounter or date goes terribly well without conversation, unless you’re a model or movie star.

– Learn to avoid the small talk.
I hate small talk; I really do. It’s useless and impersonal and typically uninteresting. Yes it *is* windy out, thanks for commenting. Sometimes small talk is necessary and it takes effort to steer from the initial tendency to small talk over to something far more interesting and personal. This is a skill I have yet to hone, but is on the list! Try to talk about something of immediate interest to the other person, like their witty Jinx shirt, the event you’re attending, the sticker on their laptop cover, or someone else nearby you can both share a laugh at. One thing to look out for: small talk is a common opener, so be sure to not scowl when it is offered, but just learn to steer away from it. I might hate it, but that might be other people’s schtick!

– Just let go.
There’s a reason alcohol starts so many parties and loosens lips (yeah, pun..uhh..intended): lowered inhibitions. Try to lower your inhibitions on your own. Who cares if you make an ass of yourself? It’ll make for a funny story later on. Who cares if you fuck up and look dumb? Do one will die and life will move on. Who cares if you misjudged someone’s interest and got an eye-roll and cold shoulder? Nothing ventured, nothing gained. Extroverts do this naturally, but us introverts have an amazingly hard time with this, myself included. As said in the above video, most everyone else is just as nervous as you are. Take a deep breath, send the inviting body language signals, and actively dip a toe in the water.

By the way, humans are the only animals that blush; or need to (Twain, I believe). Keep that in mind.

– Embrace public speaking.
This is easier to do in school when such opportunities are often unavoidable, and they come in two flavors: First, just speak up in class when a question is posed. If you’re wrong, so what? The teacher will appreciate the opportunity/chance. (I had a blast in Philosophy/Literature courses and got prof recommends for it, just because I participated whether I was right or wrong.) This is a form of public speaking and you’ll find your voice quickly. Second, speaking in front of others, front and center! If you’re in a group and need to give a presentation, volunteer to be the speaker. Seriously, you might shake while up there, but that usually is because you don’t care for what you’re speaking about or because you’re just not used to it. It really will go away if you solve both those issues, and you solve the second by simply getting up and doing it a few times. So, if you have a speech to give in college to a small class of people who likely won’t even be listening, embrace it fully and go for it. We all know how often such opportunities are never forced on us later in life and we end up just hiding and avoiding them! The end result is knowing how to hold yourself with someone’s eyes on you, and how to speak without sounding like a muttered whisper.

– Be interesting.
This might be hard to always do, but if you can get away with it, go for it. Wear a shirt that gives someone else an opportunity to see an interest of yours (Lan party shirt? You’re a gamer!) or something else that may give clues. If you’re fashionable, be fashionable. Or if you’re like me, wear your interests on your sleeve. (Even my car screams infosec since that’s what my plate says.)

By the way, you’re not a social engineer if you can’t work a room…just sayin.’

Note: this article may have first appeared in ComputerWorld, written by Joshua Corman himself in Jan 2009. I’m not sure why most of it is taken almost word-for-word and reposted (with 1 new dirty secret) these 8 months later…

Bill Brenner has a piece on Joshua Corman’s 8 dirty secrets of the it security industry. I thought I’d weigh in with some thoughts while sharing the article.

Dirty Secret 1: Vendors don’t need to be ahead of the threat, just the buyer
Individual people may reach levels of financial satisfaction and turn their attention to actually making a difference (see Jerry Maguire), but almost any group of people forming an ephemeral organization will ultimately see that organization driven by dollar signs. The more so if they are a public company. Sadly, that’s how it is. Although I think that is a tangential point to this “dirty secret.”

I’ve rewritten my paragraph about vendor-buyer expectations and relationships about 4 times now, and I keep arguing basically both sides of the coin. So I’m just going to leave it be. 🙂

Dirty Secret 2: AV certification omissions
I truly do understand this criticism. I don’t necessarily have to agree with it, but I do understand that some people think this, and that’s fine with me. To me, this might come down to what you expect your AV-type products to do. Do you expect them to catch everything, or do you expect them to be fallible, but catch most things you’re likely to care about? Or at least add some value to your overall layered security posture. So, yes, I understand we can still push our AV vendors to detect more, but I understand we may take that unrealistically too far.

Dirty Secret 3: There is no perimeter
Ugh. It’s still so freakin’ trendy to say there is no perimeter. What I love are the next two lines, “That’s not to say there is no perimeter. It’s just that companies are foggy on what the perimeter truly is…” At any rate, that’s accurate to say that our perimeter has changed dramatically in 15 years, but there is still a perimeter. Do you have a scope for PCI? There’s a perimeter. Do you have different networks with dissimilar trust levels? There’s a perimeter. Maybe we get tripped up on the connotation of a perimeter being an *outer* boundary rather than an internal boundary as well. I dunno, but the point holds up: define the perimeter, and make sure you’re not just thinking security on the outer boundary is enough.

Dirty Secret 4: Risk management threatens vendors
I think this stems from how amazingly different businesses are and how amazingly different their IT environments are. If a vendor can set your risk levels for you, they will drop their product in and pocket your money. But if you have your own levels set, chances are they can’t perfectly match up to you. They may try, but theny you end up buying products with so many goddamned features built to satisfy all the goddamned risk levels of their desired clients… Yeah, you know what I meant.

But, on the flip side, risk management might be a benefit in some cases where a product nicely matches a portion of the risk levels a business wants to address, rather than a “well, it’s good enough for now” attitude.

Dirty Secret 5: There is more to risk than weak software
The secret itself is not really arguable, but the statement that, “the latter two [weak configurations and people] are far more dangerous risks than the big bad software security flaw of the week,” is actually an arguable point. It might be argued that even most software flaws stem from weak configs or people. Or one might say many of the damaging attacks these days are software flaws, or potentially could be if someone isn’t patching diligently (let me point you to Metasploit as an example of the power to r00t via software flaws). The point is good, however, that there is more to risk than just software flaws.

Dirty Secret 6: Compliance threatens security
I think we’ve all gotten on the same page about compliance these days: compliance raises the bottom line (the lowest common denominator), but is not itself necessarily “security.” It raises awareness and starts to set the stage for actual security value.

Dirty Secret 7: Vendor blind spots allowed for Storm
I both like and dislike this item. It’s very specific to Storm as an example and has a tone that beats on AV some more. But is the problem an AV one or an OS one? I’m not sure. What I can probaly say is complexity and people are the big issues here. More complex? More cracks for things like Storm to slip into and hide.

Dirty Secret 8: Security has grown well past “do it yourself”
This is easily the most confusing item in this list. I believe there is still a lot of do-it-yourself involved in security, but I think most of that is about talented staff leading the drive, as opposed to doing something like maintaining your spam blacklist yourself.

Every month I get to review Windows patches, assign risk expectations, and start rolling out patches. I want to quickly highlight some of my sources of information on Windows patches.

1. isc.sans.org
The ISC is usually my first stop because they have a nice, compact grid that gives me a very quick overview of how many patches have been released and maybe how big a deal they may be (here’s August’s post). I really dig the mention of any active exploits in the wild.

2. Microsoft Bulletins
Obviously Microsoft’s patches are released with accompanying bulletins like this one from August 11 for MS09-039. Since I want technical information most of the time, I dig right into the Mitigations, Workarounds, and FAQ sections. If a CVE is involved, I’ll often check it out as well, along with other links in those (often vague!) advisories.

3. Microsoft Security Response Center (MSRC)
Microsoft has come a long way in their disclosure of patch and vulnerability detail. It’s like we’ve been out in the cold for years, but now every month we get a mug of hot chocolate with our patches, and it truly warms the soul. Not only is there a wealth of information here now, but I totally missed that they also do webcasts where they describe patches and common questions regarding them.

4. Microsoft’s Security Research & Defense Blog
This blog does not go over every single vulnerability or patch, but often goes into deep dives on some of the more important ones. In between patches, they also drop other information of interest to security geeks. Both this and the MSRC, in my mind, are indispensible right now.

5. The rest of the blogosphere.
I then tend to pick and choose other sources of information from my RSS feeds list. Some blogs post regularly every month, others are far more hit-and-miss, but I have no problem feeding my continued desire to read anything and everything.

Almost everyone getting started in techical security how-to articles goes through their “securing SSH” phase. Hell, everyone has their handful of things to do when securing SSH. Usually these go from 3 suggestions up to maybe 7. This article at CyberCiti goes into 20 ways to run a more secure OpenSSH server.

Fine, some of them are suggestions that you certainly may opt not to deal with, but there is a pretty darn good amount of detail here to get started and feel good about SSH security.

It is trendy to rage against security impeding people’s habits and convenience. “We need to make security user-friendly and unimpeding!” Well, that’s great, but keep in mind the flip side: some people’s habits and ‘user-friendly practices’ are bad ones.

When a side door is propped open with a bucket, is that a bad habit? Probably. Should security be attentive to this user need? Maybe. Maybe it should be a two-way door guarded by a camera and guard like the front door? Then again, that’s a business decision to make, not necessarily a security or even “pro-convenience” decision.

This is just a knee-jerk reaction to reading an essay espousing the need for security to be more attentive to user convenience. I’m just wanting to make sure we have a balance, not too much either way.

i-Hacked.com also has a nice round-up of links from Defcon. Most interesting are the pics, tools, and some music! I can’t get this at work, but if it is DJ Great Scott’s set from the Black Ball and if it is like his previous works, it should be pretty kick ass.

Strangely, I’m still looking for CTF recaps. Not that I’ve spent much time looking…

Twitter supposedly being DDoSed certainly puts the cloud in a bit more perspective. At least I hope so. Cue up a couple months of journalists opining over DDoS preventions now…

Missed Black Hat / Defcon like me? (Ok, I only really missed Defcon, I’m not paying for Black Hat…) Then catch up on the headlines listed at Security4all. (via Liquidmatrix)

Looking for a categorized list of tools for BackTrack? Check the BackTrack wiki.

Ina ddition, SynJunkie is still going over BackTrack tools in detail on his blog. Grats on the cert efforts!