Max Moser (and Lothar!) has posted a video and discussion on basically auto-pwning an iPhone. In essence, when connecting to a wireless network like a hotspot that requires you to first hit a landing page, the iPhone will helpfully automatically pop up a Safari browser window to that landing page. Let’s just say you better pray the landing page wasn’t karmetasploit in waiting. (Karma grabs you with its network, and Metasploit delivers the web payload.)

While this is amusing, one argument Apple may make (if they even bother to make one) is the iPhone is just doing automatically what the user would do anyway: open a browser window. However, this becomes really bad when the user only accidentally clicked the wrong network to join (an oops-auto-pwn) or the attacker is spoofing a legit-sounding network. (Gotcha!)

Most people I know don’t give a thought to the security of their cell phones, even though they may give some thought about it for their laptops. I don’t think it is sinking in yet that something like the iPhone is more akin to a laptop than a phone, if you ask me.

Note to self: P2P app Soulseek got patched for a recently released remotable vulnerability. Kudos. A second, similar vulnerability was released last week and the current patched client fixes it as well. Nice to see the response and patch, especially for an app site that had been inactive for a while.

Every now and then you have to poke your head out from amongst the security geek circles and see what slightly more normal people have to say about a topic. Tonight, my moment of slumming comes from the comments on a story about a recent McAfee AV update that went bad.

From calling out for alternative OS solutions (in an office environment) to denouncing all AV to not understanding scales of economy and so on, the comments remind me that the opinions of the world are far worse outside the walls of our little geekdoms.

Kinda puts it into perspective what companies have to deal with when they service both corporate and home users, eh?

McGrew is starting his posts about hunting down and getting a hacker arrested for what amounts to a SCADA attack. Via Liquidmatrix I was pointed to a very informative Register article as well.

I sometimes state that I wear a grey hat now and then, but it really is far beyond the line to actually attack a system that has as much importance as an HVAC in a medical clinic; something that can jeopardize lives both directly and indirectly. It is also a gross negligence to subvert the trust placed in someone like a security guard who is meant to protect. Highest kudos to McGrew for doing something about it rather than just ignoring the incident.

After McGrew dropped the name in IRC the other night, I did some of my own quick searching on the person. Hacker kids and little hacker groups and even minor defacements are one thing, but escalating to a degree like this is trouble. Role-playing and playing at this kind of thing is fine, if you ask me (yes, even if you find it cool to wear a gas mask), but you don’t toe that moral right and wrong line. People who do that and have certain psychological dispositions are trouble, as they really have no where else to go but further escalation past that line.

What I found most ironic was a post on a profile that said his dream job was to be with the FBI Cyber Corps. Well, at least he got an up close introduction!

ID theft has been around a very, very long time. Only with the relatively recent explosion of the Internet has it become more than just an acceptable “cost of business.” So in recent years you’d think places, like, oh I don’t know say, local banks, would have a lot more awareness of the issues and do simple things like, I don’t know, shred or securely dispose of paper waste.
I guess not. Even today…

Federal agents say Nelson said it was easy to find new victims: All he needed to do was visit a local bank and search their dumpsters.

My only complaint on the news article is this part:

CBS13 was able to find processed deposit slips and junk mail with full names and addresses in the garbage of a local bank.

With absolutely no reference on why that sort of information might be useful or dangerous. Is my full name and address sensitive information? I would hope not since it’s public…

Came across news this fine day about the RIAA settling with a woman on one of their music-pirating crusade cases because she didn’t even own a computer at the time. But what really struck me was the facepalm of this paragraph:

[Mavis] Roy, of Hudson, New Hampshire, had been charged by four record labels with downloading and distributing hundreds of songs from the Internet. A letter from the record companies’ attorneys in July 2007 directed her to a web site where she could pay by credit card to settle the case. Since she did not have a computer in her house at the time she was alleged to have downloaded the music, she ignored the requests. “For many months she thought it was just a scam…”

Why do we even bother these days? Remind me to never wonder when people say, “Well, how are we supposed to know what is a scam or what isn’t? Good question, and unless the English is broken and stupid, we really don’t know anymore. Be paranoid.

My Friday thought is this: Much like drinking while on stage at a Defcon presentation, do you swear on your blog? If you don’t swear on your blog, I submit that your blog is fucking boring. 🙂

You buy our appliance and plug it into your data center. With care, cool temperatures, and constant feeding with power and network packets (they do not have to be destined to the box, but just spanned over), the appliance will start to produce nanomites within 6 months.

These mechanical mites will first gestate inside the appliance, but will soon skitter across your network cables and fix everything wrong. They will also steal unused bits and bytes of storage and bring them back to the hiv…appliance.

After 6 more months of scavenging unused cycles and bits, the appliance will begin to produce nanomites v2: physical security. They will be constructed inside the appliance and when ready, slip out of the vents and secure your data center. Do not be alarmed if you see network cables moving as if blown by a breeze, or small shadows around the corners of the racks when no one is around. Those are just the nanomites!

They are small enough to slip unnoticed anywhere, including all of your office PCs and telephones. They are constructed to adopt such devices as their new homes and they will protect them and their security for 47 years, per their average life expectancy. If your users or the systems they use exhibit insecure tendencies or practices, they will take physical action to shock…err…correct the situation.

Hmm…so not wanting to be at work today. Need sleepy. The above inspired after seeing Rybolov’s picture of a cat appliance!

Via McKeay, I read a list of 10 things your auditor isn’t telling you, compiled by David Shackleford. Utter, terrible truths! So much so, that I had to yoink them and add comments.

If you read nothing else in this post, read my comments on #6. In fact, I’ll quote myself here: “This is where pen-tests can trump audits. A pen-test can say WRONG, but an audit is trying to say CORRECT, and it often can’t.”

1. I am actually just following a checklist.
A subjective checklist. An incomplete checklist. A checklist I can’t intelligently talk about because I don’t get it, nor can I really give you anything beyond obsurd vagueness if you ask me how to meet those checklist bullets! Oh, Dave covers some of those coming up! 🙂

2. I do not understand the technology I am auditing.
Also, too many varied ways of using varied technologies in various environments. Either you follow the checklist in #1, or you have to have a very large swath of knowledge. We’re just not close to being at the latter, yet. Kudos to any teams of auditors who have a nice cross-selection of skills that the lead can use to fill such gaps!

3. The well-dressed, experienced greyhairs came in and sold this deal, but I graduated from college 8 months ago and went through ( E&Y || IBM || Deloitte ) auditing bootcamp.
Possibly good if the guy is smurt, but honestly experience in a working environment does go a long way to “getting it,” both with technology and the how’s and why’s of business.

4. Most firms are really incentivized to help you pass.
In addition to Dave’s comments, I would say no one wants to lose business because your client only wanted a passing score. They *will* shop around to pass a weak audit rather than actually work up to passing any audit. Sad, but security will continue to be an economic function.

5. Show me a viable set of compensating controls, and I’m liable to pass you.
Just say no! Then again, combine #4 with #1 and you get #5. Don’t lose the business, but cover your ass so you’re not passing obviously wrong things. The one thing I dislike about this situation is if the controls are there, but just not really used except when the auditor is around, i.e. that AV/IPS management console full of alerts that no one ever looks at.

6. Auditing standards suck.
I’m not sure how this can get better, mostly because of what I said in #2 about varied technologies used in varied ways. *CAN* you have an easily understood Ubuntu Server build checklist? Doubtful, especially when you have no context as to what that Ubuntu Server should be doing. This is where pen-tests can trump audits. A pen-test can say WRONG, but an audit is trying to say CORRECT, and it often can’t. Yes, we can get better, but this is a Big Deal. And we all know the reaction when they see NIST docs for the first time. “Oh, just follows the recommends at NIST [and keep some Tums on hand.]”

7. Compliance regulations suck.

8. You can’t have it “your” way.
Combine this with #1, #2, and #3, and your auditor may WORSEN your security. But it is true, the audit’s real effectiveness is going to be rooted in the auditor and somewhat in the client technical staff (who may be able to pass off an auditor as being inexperienced). <--Of course, those staff that can do that probably need to be recruited into security/auditing!! 9. I know more than you.
Dave’s comments remind me why I think the trend on-going is to have in-house auditing/security. The biggest things stopping that will be a solid workforce and the Blame Game when a breach does occur. You can’t have someone blitz in for a week or two and be effective with anything but a checklist. You can’t expect a firm’s auditor to give you MSSP-like/consultant-like hours without either being gouged or limiting how many other paying clients he can handle. And you can’t always expect a client sticks to what they say, especially if they have no real security analysts whose job is to maintain such secure practices.

10. Covering my ass is my major goal.
Dave mentions the audit firm pestering to get answers/details to make sound decisions. Given #1, #2, #3, #4, and the ego-part of Dave’s comments in #9, this leads down the road of eliciting a response you want and then client wants, even if it is false. “Yes, fine, we have a log management product and sure we …watch…it…” can be written down as “Check!” even if it’s not true. “Honey! You let Billy track mud all over the living room!” “But dear, I asked if he had taken off his shoes and he said yes!” “Right, but did you actually CHECK that he was doing it?” “Wait, blame Billy, he lied about it!”

bonus: I know you probably don’t like me.
Really, we techs should like auditors. Tech/Sec managers should like their auditors. If you’re doing a good job, they legitimize it. If you’re doing a bad job because you can’t get budget, they’ll justify it. But if you’re being subpar and you know it (or don’t know it), yes, you dislike your auditors because they look at things you suck at and are asking for details that you don’t have. In that case, you need to look at them as being helpful to improve what you’re doing, not trying to expose you for a hack in front of your boss. If I’m driving stick horribly and someone gives me a tip, it’s just that…helpful!

This sounds cynical of me, but it’s likely because I’m too close to all of this to really appreciate it sometimes. Even my most cynical days are liked by some people because there is a deep thirst for security knowledge beyond sec geek circles. They just don’t like all the work we remind them needs done. No magic buttons… 🙂

I find this news particularly interesting. China’s Green Dam software is riddled with bugs? Nice!

Not only is the government lowering overall security (and illustrating that even on a national security level functionality trumps security), but homogenous systems like that scare me. A business with a standard security suite is one thing, but a country of a billion people is a whole new game. If a government ever mandated a piece of software for its citizens and businesses, I can pretty much guarantee you it will be the most tested, fuzzed, and attacked piece of software since Windows, because just one remote exploit can turn into a virtual nuke for a government whose hackers find it…

If you click the link in the link I posted (or go to this article), you get this juicy quote from the CEO of the Green Dam maker:

“We are specialists in producing Internet filtering software rather than security,” Zhang said, according told the China Daily.

Figures I would miss it this year, once they changed from winter to summer dates. The 2009 Microsoft Scripting Games are currently underway. It’s too late to truly sign up, but their challenges are as good as any excuse to start learning a scripting language. Such learning endeavors are usually killed by lack of ideas on what to use as a goal for early scripts. Events like this provide the answer!

There are only two script languages in use this year, PowerShell and VBscript. No Perl like last year.

Passing along an article discussing the recent Merrick Bank vs Savvis case, where an auditor is being sued by someone who relied on their assessment results. The title says it all, “Why suing auditors won’t solve the data breach epidemic.”

I’ve added a section of links on the page (right menu for those who only see me through RSS) for security-related LiveCDs. I know, I’m missing some old ones like PHLACK, Whax, and even Knoppix-STD, but I’d like to link only actively supported and recent editions. So far I’m only listing backtrack (duh), NST, nubuntu, owasp, pentoo, and samurai.

I may adjust this section and include virtual images as well, since there are some pen-test target and tool images out there, like the recently announced Securix Network Security Monitoring virtual image (the sheriff badge logo has got to go, lol!). Really, these days there is not too much difference between a livecd and a virtual image in your pocket, assuming you control the target system.

Matthew Hackling over at Infamous Agenda has posted a list of things to know for working in infosec. I really like this list, kinda like previous lists* I’ve pointed to or referenced. I can see a few items on here I certainly could work on!

I’m totally yoinking this list because his site doesn’t look built around getting hits (no ads, good man!), and I’d love to keep this list even if the site someday dies. To every entry he says to configure or install an app, I would also suggest living with it for more than a few days or weeks. Consider that extra credit!

1. TCP/IP basics like OSI model, routing, protocols, ports, NAT
2. Construct a checkpoint firewall rule base
3. Construct a PIX firewall rule set
4. Configure a cisco router to CIS benchmark
5. Configure VLANs and port mirroring on a cisco switch
6. Deploy Microsoft security templates to a group policy object
7. Configure a WSUS server and run MBSA to check it is working
8. Use Solaris Security Toolkit
9. Administer a linux box, enable/disable services, use package managers etc.
10. Install oracle and mysql
11. Be able to construct an SQL query or two
12. Configure a web server or two (say apache and IIS)
13. Configure an application server or three (say tomcat, websphere application server, maybe BEA weblogic)
14. Be able to use a web proxy (burp, webscarab) and a fuzzer
15. Know how the following security controls of authentication, session management, input validation and authorisation are implemented securely for a number of application development frameworks
16. Configure an IDS or three (Snort, IBM solution set)
17. Know the ten domains in ISO27002 and their content
18. Be able to identify control gaps from ISO27002 in your operations
19. Be able to build a security plan to address control gaps (planned end state, costs and benefits, dates, actions and responsibilities)

* sadly, while I can visualize the page I have in mind, I have no idea where my link to it is.

I either need two more of me, or a permanent 3- or 4-day weekend to catch up on all the little notes I send myself about tools or things to check out.

It’s not the reading of RSS feeds and news that gets me bogged down. It’s all the crazy awesome stuff out there that takes some hands-on time with to really know it.

(Ok, so I have a backlog of books to read too…)