Herein lies the story of a botnet herder. I find these sorts of stories far more interesting than vague reports on data disclosures, akin to the difference between cheesecake and rice cakes.

We thankfully have a few trends available to us that help keep these threats in check. Greed, arrogance, stupidity. While some criminals make stupid mistakes out of their pursuit of money, there are many others who are more savvy than to be obvious and brazen with their tradecraft. I guess in another lifetime if I wanted to be a cyber criminal, I would follow a few non-technical steps:

tell no one, don’t brag

always respect your adversaries, don’t be sloppy or cocky

make enough money to be comfortable, don’t be greedy

wake up

I was pondering the point of Twitter again today. It is so much like IRC. If you step away and don’t read updates for a few days (or you have a really busy list you’re following!), there is no way to really catch back up on what was said or jump back into a conversation. In fact, you likely will miss reponses even directed to you! Just like stepping away from IRC and it continuing to scroll on by.

So, I wonder when a botnet will use Twitter for command-and-control?

The SecurityWannabe has posted one of the better lists I’ve seen in some time: 10 Myths About Life As An IT Security Professional. Some I wanted to pull out:

4. You won’t learn as much as someone doing a “normal” IT job. Depending on your role in security, I find that we need to have some level of aptitude in everything IT, from scripting, to programming, to low level memory analysis, desktop troubleshooting, networking, packet analysis, web app coding and architecture, cc surveillance, wireless cracking, optimized scanning, manual scanning, and on and on. Even a jack-of-all-trades in an SMB may not know quite this much. And if we don’t know one of these topics, we know places and people to ask to get answers and self-teach.

5. Your friends will disown you – IT security is geek – but not “cool” geek. One of the best parts is being able to relate to non-geeks. For instance, my parents and I can talk to each other on their level about data theft and credit card fraud risk, or the concerns about adopting wireless in their home or at work. I can’t talk to them about coding kickass C# apps, the newest developments in virtualization, how sexy the latest big iron is, or the most recent Ubuntu release. I once even had a roommate who thought her boyfriend was looking at too much porn. And let’s just say he couldn’t do anything to stop me from keeping her well informed indeed.

An excellent list that I consider a must-read highlight so far this year.

Continuing my wiki cleanup is this list of LiveCDs with a security twist. Some of these are evolved (Auditor) while some are simply gone (Phlack). I even missed adding a few from earlier this year (Russix, Deft…)

KnoppixSTDM is a Knoppix Security distribution. Sadly, it came out as version 0.1 and remains at that level. Knoppix has tons of documentation and tutorials, including this little bit on [http://blogs.ittoolbox.com/security/investigator/archives/quick-inspection-technique-for-windows-laptops-10094 mounting a Windows disk and doing some forensics].

BackTrack is probably the most solid and most-maintained security-based live cd around right now. Extensive support for wireless and a very solid, matured distribution. This distro really has pretty much moved into the lead of security livecds, if there is such a thing.

DamnVulnerableLinux (DVL) is a very vulnerable live cd and local installation distro that is designed to teach about security and insecurity through tutorials and providing an insecure Linux installation. Really sounds like a cool idea and on par with something ike WebGOAT or the Foundstone Hackme series of exercises.

Helix is a currently maintained livecd with a forensics focus to it.

Trinity Rescue Kit is also a forensics-based livecd.

Pentoo is a Gentoo-based livecd for penetration testing and security.

nUbuntu is an Ubuntu-based livecd. While not necessarily of a security focus, it is still a solid distro. The live-cd version can also be installed locally.

Auditor has been succeeded by BackTrack, but is still a highly documented auditing and security livecd.

Nullbound looks like an in-line Snort/IDS implementation in a livecd.

OWASP Live CD Project has not really kicked off yet, but I’m hoping they are able to put something out.

Ultimate Windows Boot CD is not really a livecd in the strictest sense, but it is as close as it gets for Windows.

Phlack is another of the “original” few security livecds from a number of years back. Development has stalled, but may still get going on version 0.4.

SecureDVD is a full DVD loaded with 10 security livecd distros. This hasn’t really been maintained, but is an excellent source and reference for some other livecd distros.

Slax is a Slackware-based livecd.

I am cannibalizing some sections of my wiki to place as entries on this site simply to reorganize some stuff. Here are some links to information about network printer hacking.

Irongeek has a very thorough and well-written series of walk-throughs on playing with networked printers.

Phenoelit [old link] has done some impressive work in the past, which includes their excellent HiJetter tool.

Coincidentally, this same topic just came up on the pen-test mailing list on SecuityFocus. Perhaps some links there will someday be useful.

Matasano has updated their link to their Blackbag tool. Yes, their link has been down for quite a while..hehe. More details on what it actually does can be found on an older post at Matasano.

Anton Chuvakin throws down a doozy in discussing “Reverse Compliance or ‘Logs as Proof of Incompetence?'” Granted, he was inspired elsewhere, but he’s the first I read on this.

What if you keep so few logs that no one can prove you’ve been negligent beyond just not keeping logs? What if so few logs are kept, you don’t even need to know you’ve been hacked 2 years ago? We don’t know where these White House emails have gone, it must be our incompetence. Slap our wrists and let’s please move on…

PCI is a beast, and continues to blot out the sun with its harpy wings, wheeling in the desert sky, slowly waiting to pounce on the weak. Between concerns over requirement 6.6, code reviews, WAFs, and so on…where will this lead us? Let me play annoying Devil’s Advocate a bit.

Well, if you’re a web development shop, why go through all the friggin trouble? Rather than process and store any payment information, hire out to someone like PayPal. When you’re ready to check out, click the PayPal button which transfers you over to the PayPal site along with whatever transaction information you need. User logs in there, performs transaction there, and completes it there. Let the PayPal-type sites deal with PCI.

This way, every web dev shop won’t need a WAF or layers of security or code reviews. Not that I think they should all ditch such efforts, I just feel such efforts are too idealistic for our economic world. I know I’ve yet to hear a developer or developer manager who has any interest in spending effort, time, or money on an SDLC beyond what it takes to roll out product faster and with higher quality (quality not being defined in terms of security other than the most basic stuff like SSL support).

Of course, this means that while web shops won’t process your credit information or store it, they can and likely will store everything else about you. But, hey, that doesn’t fall under PCI!

It might seem like there is an epidemic of information disclosures in recent years. I maintain there is a companion epidemic: one of silence about the reason for these intrusions and disclosures. This prevents anyone from really learning how to improve by any other means beyond having a finger waggled at us/them or a painful ruler smacked across our cheek. (I sometimes wonder if we’re going to be stuck in a silo no matter what our efforts…)

The Daily Camera has a story about the disclosure of data on 9,500 persons from the University of Colorado (dig the off-beat green-tinted site).

Hilliard said three computers [one laptop, two desktops] in the Division of Continuing Education and Professional Studies were compromised by a “very complicated hack” that was discovered Thursday afternoon.

One man’s “complicated hack” is another man’s obviously gaping hole. Useless information.

“We think they were compromised by digital intrusion with some sort of hack,” Hilliard said, noting there is “no direct evidence the data has been taken and used for nefarious purposes.”

I’m done being nice about these things. No shit you don’t have any direct evidence of wrong-doing. If someone breaks into my house and steals my gun, I can cover my eyes and say “I have no proof a crime is being committed with it!” By the way, no kidding, “some sort of hack…” amazing.

According to Hilliard, none of the computers was [sic] supposed to have personal information stored on it, following a policy change CU implemented last fall after someone hacked into a computer issued to the College of Arts and Sciences’ Academic Advising Center.

Policies don’t actually stop anything, just like education. Both are necessary, but neither will guarantee anything. Kinda like that 35 mph sign on the road that I always drive past at 42 mph.

Every other post Hoff makes is packed with information that is way over my head, oftentimes making me lightheaded. But he continues to have great posts in between the bleeding-edge ones. I took two points from a recent post of his on the conflict between virtualization and PCI compliance (2.2.1 which wants single roles for a server may fail all host servers that “serve” multiple guests of various purposes, although I *might* argue the host serves the single purpose of hosting virtual servers).

1. Auditors and checklists will always be behind new technology.

2. Auditors need to know what the crap they’re talking about.

If they make certain observations on their audits, they know they need to field questions that may be as obvious as “how do we secure or satisfy this virtualization piece you dinged us on?” If auditors can’t answer questions like that, I wouldn’t be surprised if they decide to fluff through and try not to touch it, further miring checklists behind technology, and further not providing much real security. It all comes down to training and hands-on exposure to technology.

This is a chicken-egg scenario. Can you implement and mature new technology or do you have to wait until compliance, which may mean needing to implement and mature it to learn it…
This is made futher painful because this contradicts what I consider a rule of IT and security: Technology moves forward. There is no holding it back, putting on the brakes, or waving the yellow flag of security. It inevitably moves forward. (Fine, we can hold some things back a bit, but eventually it simply will happen.) This is especially true if new technology is economically beneficial. Companies don’t need to think bleeding-edge, but they can’t afford to be lagging badly behind the curve.

Microsoft Windows and IIS have long been a whipping boy for security issues. If you hadn’t noticed, they’re back in the spotlight, only not quite as loudly because of the technical nature of recent issues. But this year is different. Instead of Microsoft standing alone, web developers are strapped to the stocks as well.

Microsoft has a new security advisory up (April 23rd) giving vague details of a vulnerability that matches details provided by Cesar Cerrudo at HITBSecConf2008. It sounds like this is less an issue with external hackers and more an issue with trusting your developers, the ones who provide code that could possibly exploit this issue. The workarounds are a bit annoying as posted currently. I think every Windows admin has experienced angst when changing accounts that services or pools run under, and we all do so only if necessary (and cross our fingers that nothing breaks too badly). And disabling MSDTC (COM+) when your apps that run your business use COM+ is not an option. (Microsoft may as well tell us to turn off the web server and unplug the machine!) I think I would be more concerned if I were a larger hosting provider running on Windows…

The above issue does not affect Vista or Windows Server 2008, it appears.

This is paired up with a recent large scale of SQL injection attacks. Microsoft (and many others) rightly point the blame to developers and coding practices. The OS and even the coding environment can only go so far to protect against incompetent, ignorant, or rushed developers. The rest is up to the developers and those leading the developers.

Attackers continue to move up the layers.

How do you know your laptop users aren’t using their cell phone connection to access the Internet around your firewall while at work?

Thomas Ptacek continues some talk about the merits of (or lack thereof) “defense in depth” (DiD). He is not sold on DiD as a core principle for security design. Which I think is perfectly fine! Even though I believe in the value of DiD, it might not always apply in every situation.

Three things to start any DiD discussion:

1) Thomas quotes Eric about my first point: “But Eric also associates ‘depth’ with network security, not application security…” I think Eric is somewhat correct. Any discussion on DiD should start with where we’re framing the discussion, application, network, other…

2) I’ve mentioned before about security religions. There is a group who does not accept anything but truly secure “stuff.” Incremental or DiD principles need not apply. There is no use in arguing about DiD to someone who believes heavily in the absoluteness of security measures. These would be black and white people: either it is secure or not. Don’t argue DiD with someone who fanatically believes in absolute security; DiD is absolutely worthless to them.

3) How do you define DiD? I know of two different definitions. First, DiD refers to layers of defense overlapping to cover deficiencies in other layers; complementary DiD. One blanket can cover half your car when it is raining, but a second, different blanket overlapping the first one can cover the rest of your car. Second, DiD refers to layers that sit like concentric rings. If you break through one, you still have to break through several more; additive DiD. Without defining our view of DiD, none of our analogies will be appropriate to compare.

I sympathize with the points raised about causing an attacker to take more time/effort to achieve an asset (attrition) and also cause them to trip more alarms in trying to evade everything you’ve thrown in their way (delay). Notice these don’t *stop* an attacker, but they give defenders a chance to react better or avoid a compromise. Does an adhoc military base erect walls such to withstand missiles, tanks, and planes? No, they rely on detection of incoming threats and react to them. Kudos on the point of reaction, though, since many of these attacks are so quick to execute in the cyberverse. But in counter, I’d rather known after the fact than not at all.

Some comments paint what I think is a realistic vision of DiD.

One comment mentions that DiD is all about economics. This is more increasingly being called risk management. If you have layered defense where an attacker uses his known parlor tricks to get into the outer crust, but has to spend a lot of time and energy to get any farther because he’s not as knowledgable about other techniques, the risk of him bullishly continuing to try may be small.

Another comment mentions DiD should not be “an alternative to rooting out and fixing vulnerabilities.” Very true, but again this comes down to economics. It also seems to be the driving point behind WAFs. Rather than fix the code (which can be costly), just throw up a WAF and not bother fixing something that can be bandaged.

Complexity vs Security vs Economics…

(IN)SECURE Magazine Issue 16 is now available. Reminded about this by the ServerGuys!

So I’ve spent several days on Twitter, alternating between not watching to being interested in the goings-on.

My impression of Twitter is: IRC+IM+Web.

It is like IRC in meeting new people and hearing new voices, and having your voice heard to others you normally don’t interface with directly; like sitting in an IRC channel with 50 others, you can just pipe up with something and get involved. I could have use forum instead of IRC, but forums are threaded and usually slower, while IRC feedback is far quicker and linear.

It is like IM in tracking the people you like to talk to, direct messages, and so on. Unlike IRC where people come and go as they wish (minus your friend lists), IM is far more dependent on you having added them as a friend and vice versa.

And combine that with web accessibility. Companies have long fought against the time-wasters of IM and even chat (ok, fine, IRC is largely blocked because of its prevalence in bot control mechanisms), but people still want IM and chat. Hence, they now use a port 80 web interface to do essentially the same thing. If that is blocked, there are numerous other portals, site plugins, and clients to use to get the access. We’re destined to lose battles against cultural trends unless we’re an organization that absolutely requires high security.

Also, Twitter is easy to use and enjoy. There aren’t a ton of features, which I think is a key to anything “2.0” these days. I know, all sec pros should know how to use IRC and various chat clients (you’re old/middle school, right?), but the reality is not everyone has ever fired up non-web-based IRC before. So, this makes the IRC chat part of the equation much more accessible.

It is definitely not bad, and I do enjoy it, especially since I don’t get to use IM or IRC at work. Now, I can only join one public group of people in my Twitter club, but I can register other names for my other circles of buddies if I had any. 🙂 I could even have a work name and a group with just coworkers about what we’re doing or where we are.