Archive for the ‘Security’ Category

Got Balls?

Sunday, May 19th, 2013

IED Trends: Turning Tennis Balls Into Bombs

From the post:

Terrorists are relentlessly evolving tactics and techniques for IEDs (Improvised Explosive Devices), and analyzing reporting on IEDs can provide insight complementary to HUMINT on emerging militant methods. Preparing for an upcoming webcast with our friends at Terrogence, we found incidents using sports balls, particularly tennis balls and cricket balls, more frequently appearing as a delivery vehicle for explosives.

When we break these incidents from the last four months down by location, the city of Karachi in southern Pakistan stands out as a hotbed. There is also evidence that this tactic is being embraced around the globe as you can see sports balls fashioned into bombs found from Longview, Washington in the United States to Varanasi in India.

We can use Recorded Future’s Web Intelligence platform to plot out the locations where incidents have recently occurred as well as the frequency and timing.

Interesting but the military, by their stated doctrines, should be providing this information in theater specific IED briefings.

See for example: FMI 3-34.119/MCIP 3-17.01 IMPROVISED EXPLOSIVE DEVICE DEFEAT

On boobytraps (the old name) in general, see: FM 5-31 Boobytraps (1965), which includes pressure cookers (pp. 73-74) and rubber balls (p. 87).

Topic maps offer over rapid dissemination of “new” forms and checklists for where they may be found. (As opposed to static publications.)

Interesting that FM 5-31 reports an electric iron as boobytrap, but an electric iron is more likely to show up on Antiques Roadshow than as an IED.

At least in the United States.

Aaron Swartz – Accountability?

Tuesday, May 14th, 2013

Court orders names to be withheld before release of Aaron Swartz records by John Ribeiro.

From the post:

The government dismissed charges against Swartz shortly after his death. But his estate filed to remove a protective order of November 2011, barring disclosure of documents, files or records except in certain situations. The estate cited the need to disclose the records to the U.S. Congress after a House Committee on Oversight and Government Reform decided to investigate the prosecution of Swartz, and review one of the statutes under which he was charged.

MIT, JSTOR and the government, however, asked that the names and other personal identification of their staff referred to in the documents should be redacted.

(…)

The judge said the court concludes that “the estate’s interest in disclosing the identity of individuals named in the production, as it relates to enhancing the public’s understanding of the investigation and prosecution of Mr. Swartz, is substantially outweighed by the interest of the government and the victims in shielding their employees from potential retaliation.”

Well, that certainly makes sense.

The government and MIT can smear Aaron Swartz, engage in “intimidation and prosecutorial overreach,” literally drive Aaron to suicide, but after all, it’s MIT and the U.S. Attorney’s office.

Why should they be held accountable?

It’s clear the government isn’t going to hold those responsible accountable, but that doesn’t have to be the end of the story.

First, MIT donors can withhold donations to MIT unless and until such time as MIT outs all of those involved at MIT and they are no longer employed by MIT.

Second, everyone in education, industry and technology, here or abroad, can shun those outed by MIT. No jobs, no appointments, no contracts, not ever. They need a long opportunity to feel some of the pain they inflicted on Aaron Swartz.

Third, the U.S. Attorney’s office personnel should be known from court records, although holding them accountable may be more difficult.

Their conduct in this case will be a plus for the sort of law firms likely to hire them when they leave government service.

You will have to be creative in finding legal social practices to make them sincerely regret their conduct in this case.

If the government won’t act on our behalf, who else do we have to turn to?

MongoDB as in-memory DB

Thursday, May 9th, 2013

How to use MongoDB as a pure in-memory DB (Redis style) by Antoine Girbal.

From the post:

There has been a growing interest in using MongoDB as an in-memory database, meaning that the data is not stored on disk at all. This can be super useful for applications like:

  • a write-heavy cache in front of a slower RDBMS system
  • embedded systems
  • PCI compliant systems where no data should be persisted
  • unit testing where the database should be light and easily cleaned

That would be really neat indeed if it was possible: one could leverage the advanced querying / indexing capabilities of MongoDB without hitting the disk. As you probably know the disk IO (especially random) is the system bottleneck in 99% of cases, and if you are writing data you cannot avoid hitting the disk.

One sweet design choice of MongoDB is that it uses memory-mapped files to handle access to data files on disk. This means that MongoDB does not know the difference between RAM and disk, it just accesses bytes at offsets in giant arrays representing files and the OS takes care of the rest! It is this design decision that allows MongoDB to run in RAM with no modification.

Reports getting 20K writes per second on a single core.

I can imagine topic map scenarios where no data should be persisted.

You?

Cyber Infrastructure Protection (Vols. 1 and 2)

Wednesday, May 8th, 2013

Cyber Infrastructure Protection by Edited by Dr. Tarek N. Saadawi, COL Louis H. Jordan Jr. (2011)

Synopsis:

This book provides an integrated view and a comprehensive framework of the various issues relating to cyber infrastructure protection. It provides the foundation for long-term policy development, a roadmap for cyber security, and an analysis of technology challenges that impede cyber infrastructure protection. The book is divided into three main parts. Part I deals with strategy and policy issues related to cyber security. It provides a theory of cyberpower, a discussion of Internet survivability as well as large scale data breaches and the role of cyberpower in humanitarian assistance. Part II covers social and legal aspects of cyber infrastructure protection and it provides discussions concernsing the attack dynamics of politically and religiously motivated hackers. Part III discusses the technical aspects of cyber infrastructure protection including the resilience of data centers, intrusion detection, and a strong focus on IP-networks.

Cyber Infrastructure Protection: Vol. II by Edited by Dr. Tarek N. Saadawi, COL Louis H. Jordan Jr, Dr. Vincent Boudreau.

Synopsis:

Increased reliance on the Internet and other networked systems raise the risks of cyber attacks that could harm our nation’s cyber infrastructure. The cyber infrastructure encompasses a number of sectors including: the nation’s mass transit and other transportation systems; banking and financial systems; factories; energy systems and the electric power grid; and telecommunications, which increasingly rely on a complex array of computer networks, including the public Internet. However, many of these systems and networks were not built and designed with security in mind. Therefore, our cyber infrastructure contains many holes, risks, and vulnerabilities that may enable an attacker to cause damage or disrupt cyber infrastructure operations. Threats to cyber infrastructure safety and security come from hackers, terrorists, criminal groups, and sophisticated organized crime groups; even nation-states and foreign intelligence services conduct cyber warfare. Cyber attackers can introduce new viruses, worms, and bots capable of defeating many of our efforts. Costs to the economy from these threats are huge and increasing. Government, business, and academia must therefore work together to understand the threat and develop various modes of fighting cyber attacks, and to establish and enhance a framework to assess the vulnerability of our cyber infrastructure and provide strategic policy directions for the protection of such an infrastructure. This book addresses such questions as: How serious is the cyber threat? What technical and policy-based approaches are best suited to securing telecommunications networks and information systems infrastructure security? What role will government and the private sector play in homeland defense against cyber attacks on critical civilian infrastructure, financial, and logistical systems? What legal impediments exist concerning efforts to defend the nation against cyber attacks, especially in preventive, preemptive, and retaliatory actions?

Both from the Strategic Studies Institute of the U.S. Army War College.

I don’t know how “technical” part III will be but in the meantime, you can use the first two volumes as a basis for a topic map on security issues.

Either pointing to incidents that illustrate the concerns in these volumes or more “practice” oriented materials.

Controversial Cyber Security Bill CISPA…

Saturday, April 27th, 2013

Controversial Cyber Security Bill CISPA Passed Again By The US House by Avik Sarkar.

From the post:

Couple of months ago we reported that the White House is planning for an executive cyber security order, from some official sources it has also come to know that the U.S. President Mr. Barack Obama has a special plan to re-introduce the Cyber Intelligence Sharing and Protection Act (CISPA). Today that deceleration get executed as the US House of Representatives has passed the controversial Cyber Information Sharing and Protection Act. This is the second time when CISPA have been passed by the White House, first it was rejected by the Senator while saying that the bill did not do enough to protect privacy. But yet again with the initiative of Obama and a substantial majority of politicians in the House backed the bill. Though there is a huge chance of getting rejected. According to some relevant sources it has been came to light that, this time also CISPA could fail again in the Senate after threats from President Obama to veto it over privacy concerns. Sources are saying that the main reason of re-introducing CISPA is the the President Barack Obama expressed concerns that it could pose a privacy risk. The White House wants amendments so more is done to ensure the minimum amount of data is handed over in investigations.  The law is passing through the US legislative system as American federal agencies warn that malicious hackers, motivated by money or acting on behalf of foreign governments, such as China, are one of the biggest threats facing the nation.  ”If you want to take a shot across China’s bow, this is the answer,” said Mike Rogers, the Republican politician who co-wrote CISPA and chairs the House Intelligence Committee. 

Don’t be distracted by the privacy/civil liberties/cybersecurity dance in Washington, D.C.

Why would you trust a government with a kill list to balk at listening to your phone or reading your email traffic?

A government that does those things and lies to the public about them, is unworthy of trust.

Guard your privacy as best you can.

No one else is going to do it for you.

PS: Topic maps may be able to help your watch the watchers. See how they like a good dose of sunshine.

The Matasano Crypto Challenges

Saturday, April 20th, 2013

The Matasano Crypto Challenges by Maciej Ceglowski.

From the post:

I recently took some time to work through the Matasano crypto challenges, a set of 48 practical programming exercises that Thomas Ptacek and his team at Matasano Security have developed as a kind of teaching tool (and baited hook).

Much of what I know (or think I know) about security has come from reading tptacek’s comments on Hacker News, so I was intrigued when I first saw him mention the security challenges a few months ago. At the same time, I worried that I’d be way out of my depth attempting them.

As a programmer, my core strengths have always been knowing how to apologize to users, and composing funny tweets. While I can hook up a web template to a database and make the squigglies come out right, I cannot efficiently sort something for you on a whiteboard, or tell you where to get a monad. From my vantage point, crypto looms as high as Mount Olympus.

To my delight, though, I was able to get through the entire sequence. It took diligence, coffee, and a lot of graph paper, but the problems were tractable. And having completed them, I’ve become convinced that anyone whose job it is to run a production website should try them, particularly if you have no experience with application security.

Since the challenges aren’t really documented anywhere, I wanted to describe what they’re like in the hopes of persuading busy people to take the plunge.

You get the challenges in batches of eight by emailing cryptopals at Matasano, and solve them at your own pace, in the programming language of your choice. Once you finish a set, you send in the solutions and Sean unlocks the next eight. (Curiously, after the third set, Gmail started rejecting my tarball as malware.)

Most of the challenges take the form of practical attacks against common vulnerabilities, many of which will be sadly familiar to you from your own web apps. To keep things fun and fair for everyone, they ask you not to post the questions or answers online. (I cleared this post with Thomas to make sure it was spoiler-free.)

The challenges start with some basic string manipulation tasks, but after that they are grouped by theme. In most cases, you first implement something, then break it in several enlightening ways. The constructions you use will be familiar to any web programmer, but this may be the first time you have ever taken off the lid and looked at the moving parts inside.

While avoiding posting the questions/answers online, mapping vulnerabilities you uncover would make a good start on a security topic map.

I first saw this in Four short links: 19 April 2013 by Nat Torkington.

Marathon Attendees Responsible for Not Stopping Bombing

Tuesday, April 16th, 2013

National security begins with you! by Phrantceena Halres.

From the post:

The Boston Marathon incident is an unfortunate, tragic reminder that, as citizens, we must always remain aware, alert and diligent! Individuals must hone a “sixth sense” that helps them detect, anticipate and plan for danger in advance of it happening. People innately know when something is wrong, dangerous, or just “off,” and in those situations it is imperative to take action rather than just brushing it off. 

As a society we’ve been de-sensitized to our personal responsibility to secure our own surroundings. We need to teach every citizen that national security begins with you! Each of us has to take responsibility for what happens in our community and nation at large, and not just ask “what can I do better” — but take tactical action. This act of terrorism was meticulously planned and the culprits had the audacity and arrogance to commit their crime in the middle of day. I assert that somewhere along the line, someone saw something that could have been reported, which may very well have prevented this tragedy. 

With each act of terrorism, whether originating from foreign lands or home-grown, we tend to point the finger over who is not doing their job to keep us safe — but then complain about why we can’t carry more than three ounces of sunscreen in our carry-on bags catching a flight for vacation.

Given the location of these explosives, it is clear that Boston should have been on higher alert and helping residents and visitors do the same, to include educating them about how to stay S.A.F.E.: smart, aware, focused and equipped.

We’ve become a reactionary society…it shouldn’t come down to the honorable and excellent first responders responding to crime, it should be about understanding how pro-active security training (for both individuals and industry professionals) helps prevent a crime from being committed in the first place.

When I read:

I assert that somewhere along the line, someone saw something that could have been reported, which may very well have prevented this tragedy.

And that the attendees weren’t:

S.A.F.E.: smart, aware, focused and equipped.

It sounds to me like the Boston marathon attendees fell down on their job to prevent the attack.

Complete and utter paranoid nonsense.

You have no obligation to be a free and voluntary force of Stasi informants.

Nor does the government have the ability to prevent every possible mishap.

What can be done is to care for the injured and assist, if possible, in finding those responsible.

Even more importantly, to live free of fear and suspicion of others.

Otherwise, the terrorists and their counterparts like Phrantceena Halres will have won.

Let’s disappoint them.

Data-Plundering at Amazon

Saturday, April 6th, 2013

Amazon S3 storage buckets set to ‘public’ are ripe for data-plundering by Ted Samson.

From the post:

Using a combination of relatively low-tech techniques and tools, security researchers have discovered that they can access the contents of one in six Amazon Simple Storage Service (S3) buckets. Those contents range from sales records and personal employee information to source code and unprotected database backups. Much of the data could be used to stage a network attack, to compromise users accounts, or to sell on the black market.

All told, researchers managed to discover and explore nearly 2,000 buckets from which they gathered a list of more than 126 billion files. They reviewed over 40,000 publicly visible files, many of which contained sensitive information, according to Rapid 7 Senior Security Consultant Will Vandevanter.

….

The root of the problem isn’t a security hole in Amazon’s storage cloud, according to Vandevanter. Rather, he credited Amazon S3 account holders who have failed to set their buckets to private — or to put it more bluntly, organizations that have embraced the cloud without fully understanding it. The fact that all S3 buckets have predictable, publically accessible URLs doesn’t help, though.

That was close!

From the headline I thought Chinese government hackers had carelessly left Amazon S3 storage buckets open after downloading. ;-)

If you want an even lower tech technique for hacking into your network, try the following (with permission):

Call users from your internal phone system and say system passwords have been stolen and IT will monitor all logins for 72 hours. To monitor access, IT needs users logins and passwords to put tracers on accounts. Could make the difference in next quarter earnings being up or being non-existent.

After testing, are you in more danger from your internal staff than external hackers?

As you might suspect, I would be using a topic map to provide security accountability across both IT and users.

With the goal of assisting security risks to become someone else’s security risks.

Indexing PDF for OSINT and Pentesting [or Not!]

Saturday, April 6th, 2013

Indexing PDF for OSINT and Pentesting by Alejandro Nolla.

From the post:

Most of us, when conducting OSINT tasks or gathering information for preparing a pentest, draw on Google hacking techniques like site:company.acme filetype:pdf “for internal use only” or something similar to search for potential sensitive information uploaded by mistake. At other times, a customer will ask us to find out if through negligence they have leaked this kind of sensitive information and we proceed to make some google hacking fu.

But, what happens if we don’t want to make this queries against Google and, furthermore, follow links from search that could potentially leak referrers? Sure we could download documents and review them manually in local but it’s boring and time consuming. Here is where Apache Solr comes into play for processing documents and creating an index of them to give us almost real time searching capabilities.

A nice outline of using Solr for internal security testing of PDF files.

At the same time, a nice outline of using Solr for external security testing of PDF files. ;-)

You can sweep sites for new PDF files on a periodic basis and retain only those meeting a particular criteria.

Low grade ore but even low grade ore can have a small diamond every now and again.

Permission Resolution with Neo4j – Part 1

Saturday, March 30th, 2013

Permission Resolution with Neo4j – Part 1 by Max De Marzi.

From the post:

People produce a lot of content. Messages, text files, spreadsheets, presentations, reports, financials, etc, the list goes on. Usually organizations want to have a repository of all this content centralized somewhere (just in case a laptop breaks, gets lost or stolen for example). This leads to some kind of grouping and permission structure. You don’t want employees seeing each other’s HR records, unless they work for HR, same for Payroll, or unreleased quarterly numbers, etc. As this data grows it no longer becomes easy to simply navigate and a search engine is required to make sense of it all.

But what if your search engine returns 1000 results for a query and the user doing the search is supposed to only have access to see 4 things? How do you handle this? Check the user permissions on each file realtime? Slow. Pre-calculate all document permissions for a user on login? Slow and what if new documents are created or permissions change between logins? Does the system scale at 1M documents, 10M documents, 100M documents?

Search is one example of a need to restrict viewing results but browsing raises the same issues. Or display of information along side other information.

As I recall, Netware 4.1 (other versions as well no doubt) had the capability for a sysadmin to create sub-sysadmins, say for accounting or HR, that could hide information from the sysadmin. That was prior to search being commonly available.

What other security for search result schemes are out there?

Countering Weapons of Mass Destruction

Friday, March 29th, 2013

The Project on Advanced Systems and Concepts for Countering Weapons of Mass Destruction (PASCC) at the Naval Postgraduate School

From opportunity:

This BAA’s primary objective is to attract outstanding researchers and scholars who will research topics of interest to the security studies community. Research will focus on expanding knowledge related to countering weapons of mass destruction and weapons of mass effect (WMD/WME). The program solicits innovative proposals for research on WMD/WME counter proliferation, nonproliferation, and strategy to be conducted mainly during the January 2014 through September 2015 timeframe. In this BAA, the phrase “security studies research” refers to research in all disciplines, fields, and domains that (1) are involved in expanding knowledge for national defense, and (2) could potentially improve policy and international relations for combating WMD. Disciplines include, but are not limited to: Political science, sociology, history, biology, chemistry, economics, homeland defense, and public policy.

Applications don’t close until March 31, 2014 but there isn’t any reason to wait until the last minute to apply. ;-)

Don’t know but information sharing across agencies could be an issue, along with other areas where topic maps would really shine.


BTW, some representative research from this program.

Let’s do this the hard way [Topic Map Security]

Thursday, March 28th, 2013

Let’s do this the hard way by Edd Dumbill.

Discovery of high profile security vulnerabilities (Rails, MongoDB) caused Edd to pen this suggestion for software security:

But perhaps we are in need of an inversion of philosophy. Where Internet programming is concerned, everyone is quick to quote Postel’s law: “Be conservative in what you do, be liberal in what you accept from others.”

The fact of it is that being liberal in what you accept is really hard. You basically have two options: look carefully for only the information you need, which I think is the spirit of Postel’s law, or implement something powerful that will take care of many use cases. This latter strategy, though seemingly quicker and more future-proof, is what often leads to bugs and security holes, as unintended applications of powerful parsers manifest themselves.

My conclusion is this: use whatever language makes sense, but be systematically paranoid. Be liberal in what you accept, but conservative about what you believe.

Which raises the little noticed question of topic map security.

Take for instance, if you are using the TMDM model for a topic map and someone submits the topic map equivalent of “spam.” That is a topic that has the same subject identifier as some legitimate topic in your map but it is an ad to get you into “bikini shape.”

My inbox has seen a rash of those lately. I shudder to think what I would look like in “bikini shape.” It would be good for others, not so much for me. ;-)

Or a topic that has a set of subject identifiers that causes merging between topics that should not be merged. Possibly overloading your system or at the very least, causing a disruption to your users.

There are no standard solutions to topic map security although I suspect some users/vendors have hand crafted their own.

To be taken seriously in these security conscious times, I think we need to extend the topic maps standard to provide for topic map security.

Suggestions and proposals welcome!

Improved Part-of-Speech Tagging… [Boiling the Ocean?]

Sunday, March 24th, 2013

Improved Part-of-Speech Tagging for Online Conversational Text with Word Clusters by Olutobi Owoputi, Brendan O’Connor, Chris Dyer, Kevin Gimpely, Nathan Schneider and Noah A. Smith.

Abstract:

We consider the problem of part-of-speech tagging for informal, online conversational text. We systematically evaluate the use of large-scale unsupervised word clustering and new lexical features to improve tagging accuracy. With these features, our system achieves state-of-the-art tagging results on both Twitter and IRC POS tagging tasks; Twitter tagging is improved from 90% to 93% accuracy (more than 3% absolute). Qualitative analysis of these word clusters yields insights about NLP and linguistic phenomena in this genre. Additionally, we contribute the first POS annotation guidelines for such text and release a new dataset of English language tweets annotated using these guidelines. Tagging software, annotation guidelines, and large-scale word clusters are available at: http://www.ark.cs.cmu.edu/TweetNLP This paper describes release 0.3 of the “CMU Twitter Part-of-Speech Tagger” and annotated data.

This is great work but if I am interested in tweets from a particular set of users who share a common vocabulary, isn’t this like boiling the ocean?

That is if I have a defined source of data, I no longer have to guess or model what might have been meant.

TweetNLP would be very useful in such a case but not as a direct means of analysis.

TweetNLP could derive the norms or patterns found in tweets so that a constructed language for communicating via tweets would fit within those norms.

Another aspect of hiding in a data stream.

Remains a “boiling the ocean” exercise, but for those who want to distinguish ordinary tweets from those that only look like ordinary tweets.

I first saw this in a tweet by Brendan O’Connor.

Top Ten Web Hacking Techniques of 2012

Sunday, March 24th, 2013

Top Ten Web Hacking Techniques of 2012 by Jeremiah Grossman.

From the post:

Every year the security community produces a stunning amount of new Web hacking techniques that are published in various white papers, blog posts, magazine articles, mailing list emails, conference presentations, etc. Within the thousands of pages are the latest ways to attack websites, Web browsers, Web proxies, and their mobile platform equivilents. Beyond individual vulnerabilities with CVE numbers or system compromises, here we are solely focused on new and creative methods of Web-based attack. Now it its seventh year, The Top Ten Web Hacking Techniques list encourages information sharing, provides a centralized knowledge-base, and recognizes researchers who contribute excellent work. Past Top Tens and the number of new attack techniques discovered in each year: 2006 (65), 2007 (83), 2008 (70), 2009 (82), 2010 (69), 2011 (51)

The comments have useful material as well.

I first saw this in a post by Ajay Ohri, Hacking for Beginners- Top Website Hacks. Ajay points to a favorite hacking presentation from 2002: Top Ten Web Attacks.

I haven’t looked but suspect a majority of the 2002 top ten still work.

Or at least still work on some sites.

That’s where a topic map of vulnerabilities to sites would come in handy. Either to make the case to plug the holes or other uses.

Topic Maps as Overkill for Cybersecurity?

Saturday, March 23rd, 2013

I don’t know about for hackers but for defenders, topic maps may be overkill for cybersecurity.

I say “overkill” because the average victim isn’t facing a highly skilled and dedicated opponent.

They are facing script kiddies and are vulnerable because of their own ineptitude.

If you are already inept, topic maps aren’t going to help you. Not with cybersecurity or any other mission critical issue.

Doubtful?

Read James A. Lewis, Raising the Bar for Cybersecurity in full but consider these four facts:

  • More than 90% of the successful breaches required on the most basic techniques.
  • 85% of breaches took months to be discovered; the average time is five months.
  • 96% of successful breaches could have been avoided if the victim had put in simple or intermediate controls.
  • 75% of attacks use publicly known vulnerabilities in commercial software that could be prevented by regular patching.

The only commercial opportunity I see for topic maps, other than for A game players to keep their competitive edge, would be mapping the vulnerabilities of commercial software by versions/patches.

Just to save hackers from exposing themselves on the web searching for appropriate hacks.

Active Defense Harbinger Distribution (ADHD)

Wednesday, March 20th, 2013

Active Defense Harbinger Distribution (ADHD)

Description:

The Active Defense Harbinger Distribution (ADHD) is a Linux distro based on Ubuntu 12.04 LTS. It comes with many tools aimed at active defense preinstalled and configured. The purpose of this distribution is to aid defenders by giving them tools to “strike back” at the bad guys.

ADHD has tools whose functions range from interfering with the attackers’ reconnaissance to compromising the attackers’ systems. Innocent bystanders will never notice anything out of the ordinary as the active defense mechanisms are triggered by malicious activity such as network scanning or connecting to restricted services.

SANS sponsored: Special Webcast: Active Defense Harbinger Distribution – Defense is Cool Again

Along with “big data,” cybersecurity is an up and coming area for employment.

Topic maps, giving you the ability to keep found information found, give you an advantage in either field.

I first saw this in: DARPA’S Cyber Tools: We have had our hands on DARPA’s distribution platform for cyber defense tools. No links to the SANS webinar or ADHD.

Cybersecurity Blogs

Tuesday, March 19th, 2013

I have been looking for a starting collection of cybersecurity blogs and encountered Security Blogs at convert.io today.

I count ninety-two (92) blogs listed as of this morning.

I haven’t loaded them into a reader to judge how active or timely they are as a whole.

Suggestions on other blog lists for cybersecurity?

Thanks!

Internet Census 2012

Tuesday, March 19th, 2013

Internet Census 2012

Abstract:

While playing around with the Nmap Scripting Engine (NSE) we discovered an amazing number of open embedded devices on the Internet. Many of them are based on Linux and allow login to standard BusyBox with empty or default credentials. We used these devices to build a distributed port scanner to scan all IPv4 addresses. These scans include service probes for the most common ports, ICMP ping, reverse DNS and SYN scans. We analyzed some of the data to get an estimation of the IP address usage.

All data gathered during our research is released into the public domain for further study.

Interesting paper, not to mention compressed with ZPAQ, 568GB of data. Unpacked, about 9TB of log data.

The topic map use case being to map this port data with other information resources.

Maybe time to get an extra external disk drive. ;-)

I first saw this in a tweet by Jason Trost.

Permission Resolution With Neo4j – Part 1

Monday, March 18th, 2013

Permission Resolution With Neo4j – Part 1 by Max De Marzi.

From the post:

People produce a lot of content. Messages, text files, spreadsheets, presentations, reports, financials, etc, the list goes on. Usually organizations want to have a repository of all this content centralized somewhere (just in case a laptop breaks, gets lost or stolen for example). This leads to some kind of grouping and permission structure. You don’t want employees seeing each other’s HR records, unless they work for HR, same for Payroll, or unreleased quarterly numbers, etc. As this data grows it no longer becomes easy to simply navigate and a search engine is required to make sense of it all.

But what if your search engine returns 1000 results for a query and the user doing the search is supposed to only have access to see 4 things? How do you handle this? Check the user permissions on each file realtime? Slow. Pre-calculate all document permissions for a user on login? Slow and what if new documents are created or permissions change between logins? Does the system scale at 1M documents, 10M documents, 100M documents?

Max addresses the scaling issue by checking only the results from a search. So to that extent, the side of the document store becomes irrelevant.

At least if you have a smallish number of results from the search.

I haven’t seen part 2 but another scale tactic would be to limit access to indexes by permissions. Segregating human resources, accounting, etc.

Looking forward to where Max takes this one.

Treacherous backdoor found in TP-Link routers

Sunday, March 17th, 2013

Treacherous backdoor found in TP-Link routers

From the post:

Security experts in Poland have discovered a treacherous backdoor in various router models made by TP-Link. When a specially crafted URL is called, the router will respond by downloading and executing a file from the accessing computer, reports Michał Sajdak from Securitum.

Said to affect: TL-WDR4300 and TL-WR743ND models.

I read this bulletin and now you have read my post about it.

How do I capture this information so it can be recovered by anyone purchasing or interacting with TP-Link routers?

Or better yet, pushed to anyone who is at an online purchasing site?

In the flood of security flaws I am not going to remember this tidbit past tomorrow or maybe the next day.

Moreover, whatever defect is causing this issue, likely exists elsewhere. How do I capture that information as well?

In case you are interested: TP-Link.

Black Hat USA 2013

Thursday, March 14th, 2013

Black Hat USA 2013

Deadline for submission: April 15, 2013 (But may close earlier if enough quality submission are received.)

Conference: July 27, 2013 – August 1, 2013.

Probably the best call for papers you will see all year:

WHAT ARE THE BLACK HAT BRIEFINGS?

The Black Hat Briefings was created to fill the need for computer security professionals to better understand the security risks to information infrastructures and computer systems. Black Hat accomplishes this by assembling a group of vendor-neutral security professionals and having them speak candidly about the problems businesses and Governments face as well as potential solutions to those problems. No gimmicks – just straight talk by people who make it their business to know the information security space. The following timeslots are available: 25, 50 and 120 minutes (please note the 120 minute timeslots are only available for workshops).

as opposed to long list of eligible topics.

You doubt your topic will be acceptable, then it probably isn’t.

Subject identity is a thread that runs through out cybersecurity.

From repeating the same software flaws under different names, not catching the same software flaws in testing and failing to repair/exploit flaws known by other identities, are just some of the issue areas.

To say nothing of mapping the diverse literature on cybersecurity.

“Mixed Messages” on Cybersecurity [China ranks #12 among cyber-attackers]

Thursday, March 14th, 2013

Do you remember the “mixed messages” Dibert cartoon?

Mixed Messages

Where an “honest” answer meant “mixed messages?”

I had that feeling this morning when I read: Mark Rockwell’s post: German telecom company provides real-time map of Cyber attacks.

From the post:

In hopes of blunting mounting electronic assaults, a German telecommunications carrier unveiled a free online capability that shows where Cyber attacks are happening around the world in real time.

Deutsche Telekom, parent company of T-Mobile, put up what it calls its “Security dashboard” portal on March 6. The map, said the company, is based on attacks on its purpose-built network of decoy “honeypot” systems at 90 locations worldwide

Deutsche Telekom said it launched the online portal at the CeBIT telecommunications trade show in Hanover, Germany, to increase the visibility of advancing electronic threats.

“New cyber attacks on companies and institutions are found every day. Deutsche Telekom alone records up to 450,000 attacks per day on its honeypot systems and the number is rising. We need greater transparency about the threat situation. With its security radar, Deutsche Telekom is helping to achieve this,” said Thomas Kremer, board member responsible for Data Privacy, Legal Affairs and Compliance.

Which has a handy chart of the sources of attacks over the last month:

Top 15 of Source Countries (Last month)

Source of Attack Number of Attacks
Russia Russian Federation 2,402,722
Taiwan, Province of China 907,102
Germany 780,425
Ukraine 566,531
Hungary 367,966
United States 355,341
Romania 350,948
Brazil 337,977
Italy 288,607
Australia 255,777
Argentina 185,720
China 168,146
Poland 162,235
Israel 143,943
Japan 133,908

By measured “attacks,” the geographic location of China (not the Chinese government) is #12 as an origin of cyber-attacks.

After Russia, Taiwan (Province of China), Germany, Ukraine, Hungary, United States, and others.

Just in case you missed several recent news cycles, the Chinese government was being singled out as a cyber-attacker for policy or marketing reasons that are not clear.

This service makes the specious nature of those accusations apparent, although the motivations behind the reports remains unclear.

Before you incorporate any government data or report into a topic map, you should verify the information with at least two or more independent sources.

Worldwide Threat Assessment…

Thursday, March 14th, 2013

Worldwide Threat Assessment of the US Intelligence Community, Senate Select Committee on Intelligence, James R. Clapper, Director of National Intelligence, March 12, 2013.

Thought you might be interested in the cybersecurity parts, marketing literature stuff if your interests lie towards security issues.

It has tidbits like this one:

Foreign intelligence and security services have penetrated numerous computer networks of US Government, business, academic, and private sector entities. Most detected activity has targeted unclassified networks connected to the Internet, but foreign cyber actors are also targeting classified networks. Importantly, much of the nation’s critical proprietary data are on sensitive but unclassified networks; the same is true for most of our closest allies. (emphasis added)

Just curious, if you discovered your retirement funds were in your mail box, would you move them to a more secure location?

Depending on the products or services you are selling, the report may have other marketing information.

I first saw this in a tweet by Jeffrey Carr.

Hiding in Plain Sight/Being Secure From The NSA

Wednesday, March 13th, 2013

I presume that if a message can be “overhear,” electronically or otherwise, it is likely the NSA and other “fictional” groups are capturing it.

The use of encryption marks you as a possible source of interest.

You can use image-based steganography to conceal messages but that requires large file sizes and is subject to other attacks.

Professor Abdelrahman Desoky of the University of Maryland in Baltimore County, USA, suggests that messages can be hidden in plain sight, but changing the wording of jokes to carry a secret message.

Desoky suggests that instead of using a humdrum text document and modifying it in a codified way to embed a secret message, correspondents could use a joke to hide their true meaning. As such, he has developed an Automatic Joke Generation Based Steganography Methodology (Jokestega) that takes advantage of recent software that can automatically write pun-type jokes using large dictionary databases. Among the automatic joke generators available are: The MIT Project, Chuck Norris Joke Generator, Jokes2000, The Joke Generator dot Com and the Online Joke Generator System (pickuplinegen).

A simple example might be to hide the code word “shaking” in the following auto-joke. The original question and answer joke is “Where do milk shakes come from?” and the correct answer would be “From nervous cows.” So far, so funny. But, the system can substitute the word “shaking” for “nervous” and still retain the humor so that the answer becomes “From shaking cows.” It loses some of its wit, but still makes sense and we are not all Bob Hopes, after all. [Hiding Secret Messages in Email Jokes]

Or if you prefer the original article abstract:

This paper presents a novel steganography methodology, namely Automatic Joke Generation Based Steganography Methodology (Jokestega), that pursues textual jokes in order to hide messages. Basically, Jokestega methodology takes advantage of recent advances in Automatic Jokes Generation (AJG) techniques to automate the generation of textual steganographic cover. In a corpus of jokes, one may judge a number of documents to be the same joke although letters, locations, and other details are different. Generally, joke and puns could be retold with totally different vocabulary, while still retaining their identities. Therefore, Jokestega pursues the common variations among jokes to conceal data. Furthermore, when someone is joking, anything may be said which legitimises the use of joke-based steganography. This makes employing textual jokes very attractive as steganographic carrier for camouflaging data. It is worth noting that Jokestega follows Nostega paradigm, which implies that joke-cover is noiseless. The validation results demonstrate the effectiveness of Jokestega. is only available to individual subscribers or to users at subscribing institutions. [Jokestega: automatic joke generation-based steganography methodology by Abdelrahman Desoky. International Journal of Security and Networks (IJSN), Vol. 7, No. 3, 2012]

If you are interested, other publications by Professor Desoky are listed here.

Occurs to me that topic maps offer the means to create steganography chains over public channels. The sender may know its meaning but there can be several links in the chain of transmission that change the message but have no knowledge of its meaning. And/or that don’t represent traceable links in the chain.

With every “hop” and/or mapping of the terms to another vocabulary, the task of statistical analysis grows more difficult.

Not the equivalent of highly secure communication networks, the contents of which can be copied onto a Lady Gaga DVD, but then not everyone needs that level of security.

Some people need cheaper but more secure systems for communication.

Will devote some more thought to the outline of a topic map system for hiding content in plain sight.

Open Source for Cybersecurity?

Thursday, March 7th, 2013

A couple of weeks ago I posted: Crowdsourcing Cybersecurity: A Proposal (Part 1) and Crowdsourcing Cybersecurity: A Proposal (Part 2), concluding that publicity (not secrecy) about security flaws would enhance cybersecurity.

Then this week I read:

A classic open source koan is that “with many eyes, all bugs become shallow.” In IT security, is it that with many eyes, all worms become shallow?

Burton: What the Department of Defense said was if someone has malicious intent and the code isn’t available, they’ll have some way of getting the code. But if it is available and everyone has access to it, then any vulnerabilities that are there are much more likely to be corrected than before they’re exploited.

(From Alex Howard’s interview of CFPB ( Consumer Financial Protection Bureau ) CIO Chris Willey (@ChrisWilleyDC) and acting deputy CIO Matthew Burton (@MatthewBurton), reported in: Open source is interoperable with smarter government at the CFPB.

If the “white hats” aren’t going to recognize the benefits of crowdsourcing cybersecurity, perhaps it is time for the “black hats” to take up the mantle of crowdsourcing.

Perhaps that will force the “white hats” to adapt better security measures than “security by secrecy.”

Public mappings of security flaws anyone?


Update: DARPA to Turn Off Funding for Hackers Pursuing Cybersecurity Research

The Pentagon is scuttling a program that awards grants to reformed hackers and security professionals for short-term research with game-changing potential, according to cybersecurity firm Kaspersky Lab.

That’s the ticket. If we don’t know it, it must not be known.

The Jigsaw secure distributed file system [TM Equivalents?]

Sunday, March 3rd, 2013

The Jigsaw secure distributed file system by Jiang Biana and Remzi Seker.

Abstract:

The Jigsaw Distributed File System (JigDFS) aims to securely store and retrieve files on large scale networks. The design of JigDFS is driven by the privacy needs of its users. Files in JigDFS are sliced into small segments using an Information Dispersal Algorithm (IDA) and distributed onto different nodes recursively. JigDFS provides fault-tolerance against node failures while assuring confidentiality, integrity, and availability of the stored data. Layered encryption is applied to each file segment with keys produced by a hashed-key chain algorithm. Recursive IDA and layered encryption enhance users’ anonymity and provide a degree of plausible deniability. JigDFS is envisioned to be an ideal long-term storage solution for developing secure data archiving systems.

Very interesting!

Reminds me that data could be split into topics, which only merge if you know the basis for meaningful merger. Otherwise it is a schema-free bag of tuples. ;-)

In other words, you know someone in a population of 10,000 medical records is HIV positive but without the proper merging key, it isn’t possible to say who?

I first saw this at Datanami.

Project Rhino

Sunday, March 3rd, 2013

Project Rhino

Is Wintel becoming Hintel? ;-)

If history is a guide, that might not be a bad thing.

From the project page:

As Hadoop extends into new markets and sees new use cases with security and compliance challenges, the benefits of processing sensitive and legally protected data with all Hadoop projects and HBase must be coupled with protection for private information that limits performance impact. Project Rhino is our open source effort to enhance the existing data protection capabilities of the Hadoop ecosystem to address these challenges, and contribute the code back to Apache.

The core of the Apache Hadoop ecosystem as it is commonly understood is:

  • Core: A set of shared libraries
  • HDFS: The Hadoop filesystem
  • MapReduce: Parallel computation framework
  • ZooKeeper: Configuration management and coordination
  • HBase: Column-oriented database on HDFS
  • Hive: Data warehouse on HDFS with SQL-like access
  • Pig: Higher-level programming language for Hadoop computations
  • Oozie: Orchestration and workflow management
  • Mahout: A library of machine learning and data mining algorithms
  • Flume: Collection and import of log and event data
  • Sqoop: Imports data from relational databases

These components are all separate projects and therefore cross cutting concerns like authN, authZ, a consistent security policy framework, consistent authorization model and audit coverage loosely coordinated. Some security features expected by our customers, such as encryption, are simply missing. Our aim is to take a full stack view and work with the individual projects toward consistent concepts and capabilities, filling gaps as we go.

Like I said, might not be a bad thing!

Different from recent government rantings. Focused on a particular stack with the intent to analyze that stack, not the world at large, and to make specific improvements (read measurable results).

Developing a Framework To Improve Critical Infrastructure Cybersecurity

Thursday, February 28th, 2013

Developing a Framework To Improve Critical Infrastructure Cybersecurity

Request for Information:

Summary:

The National Institute of Standards and Technology (NIST) is conducting a comprehensive review to develop a framework to reduce cyber risks to critical infrastructure1 (the “Cybersecurity Framework” or “Framework”). The Framework will consist of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks.

1For the purposes of this RFI the term “critical infrastructure” has the meaning given the term in 42 U.S.C. 5195c(e), “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”

This RFI requests information to help identify, refine, and guide the many interrelated considerations, challenges, and efforts needed to develop the Framework. In developing the Cybersecurity Framework, NIST will consult with the Secretary of Homeland Security, the National Security Agency, Sector-Specific Agencies and other interested agencies including the Office of Management and Budget, owners and operators of critical infrastructure, and other stakeholders including other relevant agencies, independent regulatory agencies, State, local, territorial and tribal governments. The Framework will be developed through an open public review and comment process that will include workshops and other opportunities to provide input.

Read the RFI and consider submitting comments (deadline 5:00 p.m. Eastern time on Monday, April 8, 2013) on how topic maps could play a role in the proposed framework.

Cybersecurity will be a “hot” property for several years so a fruitful area for marketing topic maps.*


* I commented earlier today on the possible use of topic maps with 14th century cooking texts. That is also a market for topic maps but less than a baker’s dozen of potential customers. Most of who are poor.

The cybersecurity market is much larger, has many customers who are not poor, and who are on both sides of the question. Always nice to have an arms race type market.

Are Googly Eyes Spying (on you)?

Monday, February 25th, 2013

Felix Salmon’s The long arm of the Google raises serious privacy issues.

A bond king recovering $10 million in stolen art warms everyone’s heart, but what other law enforcement searches are being done Google’s assistance?

Are they collecting data on searches for:

  • “Root kit”
  • Bomb making
  • Cybersecurity
  • Sources of guns or ammunition
  • Partners with sexual preferences
  • Your searches correlated with those of others

Hard to say and I would not trust any answer from Google or law enforcement on the subject.

Avoiding script kiddie spying by search engines requires the use of proxy servers or services such as Tor (anonymity network).

But none of those methods is immune from attack and all require technical skill and vigilance on the part of a user.

Let me sketch out a possible solution, at least for web searching.

What if you had:

  1. A human search service to do a curated search
  2. The search results are packaged for HTTP pickup
  3. A web server running in no-log mode. Never logs any data. Can pass the ID of your search for retrieval but that is all that it knows.

Thinking of a curated search because you don’t have the full interactivity of a live search.

Having a person curate the results would get you higher quality results. Like using a librarian.

Would not be free but you would not have Google, local, state and federal law enforcement looking over your shoulder.

What is it they say?

Freedom is never free.

TCP Traceroute

Monday, February 25th, 2013

TCP Traceroute by Peteris Krumins.

From the post:

Did you know you could traceroute over the TCP protocol?

The regular traceroute usually uses either ICMP or UDP protocols. Unfortunately firewalls and routers often block the ICMP protocol completely or disallow the ICMP echo requests (ping requests), and/or block various UDP ports.

However you’d rarely have firewalls and routers drop TCP protocol on port 80 because it’s the web’s port.

Check this out. Let’s try to traceroute www.microsoft.com using ICMP protocol:

Certainly a way to document subjects along a TCP route.

Can you think of other reasons to use traceroute?