Unintelligent filtering – Internet filtering is stupid, bad, dangerous, and worthless

Yesterday at work, I saw an article over at Ars Technica that I wanted to read. It was a news update on the substitute teacher who was convicted of showing porn to students after the spyware infected class PC started showing porn pop-up images. If you aren’t already familiar with the story, there are a large number of articles on the story’s beginning and evolution over at boingboing. I had already read some about the latest in the story – Ms. Amero has been granted a new trial in place of the sentencing she was supposed to receive today – but wanted to read the Ars Technica take on this simply because I respect the authors at Ars and value their views.

Rather than getting to read the full Ars story, however, I get the following block page (Click ‘More’ for image – click the image for a larger view).

More »

Microsoft security engineer shows simple wireless network break-in tools

I love security. I really need to get a good job back in the computer security industry. If I could track down a decent job in security, I’d get to play with cool software like the wireless security breaking tools demonstrated by Microsoft’s Marcus Murray (more information on this session on Murray’s blog).

ORLANDO – During an updated version of one of the more popular sessions at TechEd each year, senior security engineer and Microsoft MVP Marcus Murray did attendees a major service by demonstrating that hacking into a network is not really an art, and in some ways, not even much of a science.

His “Why I Can Hack Your Network in a Day” session is actually something of a misnomer, as many of the tools he uses (including one written by SysInternals guru-turned-Microsoft fellow Mark Russinovich) can enable individuals to work their way to revealing the passwords of domain administrators in closer to 15 minutes.

Of course, this is just a case of technology allowing transfer of skill – one security expert figures out the vulnerability, encases it in a point-and-click tool, and shares with the world. But it is still interesting to see what is going on in the back-and-forth of improved security/improved breaking of security fight. As always, security experts will look at the exploited vulnerabilities, come up with ways to reduce or eliminate them, improve protocols, and release equipment with the improved protocols. This will be followed by the break-in experts analyzing the new protocols, looking for direct and secondary/side-channel attacks, determining weaknesses, exploiting those weaknesses, and releasing simple tools that allow less skilled attackers break the security. Around and around it goes, until the eventual heat death of the universe or until we all start communicating via telepathy (which will probably get hacked somehow, in which case evolution will create better telepaths, and so on).

Technorati Tags:

The JFK plot

I know there has been plenty of news lately about the plot to blow up JFK airport, but I haven’t bothered writing anything about it. I have had someone contact me to ask me why, since I’ve covered a number of other terrorist plots or physical security issues in the past. The main reason is that this planned attack just wasn’t very feasible, nor was the attack likely to have had any success.

Safeguards in the fuel delivery grid greatly limit the amount of damage that can be done by intentional or accidental explosion/destruction/burning of any section of the fuel system. Additionally, jet fuel contains additives specifically designed to reduce the chance of explosion, increase the difficulty of catastrophic fire, and minimize spread of flames in general. Yes, the stuff burns, but it actually does not burn well enough to have very much of a chance of the spectacular destruction it seems the attackers had in mind.

Though Mr. Defreitas had lived in Brooklyn and Queens, he told the informant that his resentment of the United States hardened into hatred during his years as a cargo worker at the airport.

“He saw military parts being shipped to Israel, including missiles, that would be used to kill Muslims,” the complaint read. Mr. Defreitas, who was secretly recorded by the informant, complained bitterly that he “wanted to do something” and that “Muslims always incur the wrath of the world while Jews get a pass.”

Mr. Defreitas envisioned “the destruction of the whole of Kennedy” and theorized that because of underground pipes, “part of Queens would explode.” He boasted that in addition to a huge of loss of life – “even the twin towers can’t touch it,” he said – the attack would devastate the United States economy and strike a deep symbolic blow against a national icon, President John F. Kennedy, officials said.

Sure, it sounds scary and stuff, but the explosion he dreamed of just wasn’t going to happen. And given how much I’ve written about improbable attacks and the over-reaction of Americans to these things, I was planning on giving this incident a pass. I’m tired of wasting my time detailing the weaknesses of bad, weak, improbable and infeasible threats. You’ll note that I’ve not even taken the time to provide links backing up my claims on infeasibility and difficulty of any success. That’s because the whole plot was so ludicrously bad that I don’t want to waste more of my time pointing out specifics. You can spend a few minutes online and easily find reputable sources supporting what I’ve stated above. If you disagree, please post it in the comments and I’ll be glad to expand on the topic. But unless someone really thinks this attack was worth worrying about, I’m not going to waste more time on it. That is, unless the government does something else stupid to strip away our freedoms as a result. Then, you can be sure I’ll come back to bitch about the poor job our government is doing.

Technorati Tags:

Major slip from Astroglide manufacturer

If you’ve ordered a free sample from Astroglide maker BioFilm in the past 4 years, there’s a good chance your contact information – specifically name and mailing address – was out on the web for all to see. Of course, I’m sure many of you will claim to have never ordered the free sample, but since I know how much married men like to prevent hand-chafing, I’m sure there are a few liars saying this. Admittedly, having someone get just your name and address is no big deal, but security slips like this are sadly frequent. Remember how easily this happened next time you try signing up for something free online.

More than 250,000 people’s names and addresses are now naked on the web after the maker of a popular sexual lubricant called Astroglide accidentally exposed lists of people who bought or requested free samples of its products, proving that there’s no such thing as a free lubricant. BioFilm, a privately-held California company specializing in sexual lubricants, exposed customer data files dating from 2003 to 2007 to Google’s search engine in early April. Google then indexed the pages and made local cache copies. A search on an individual’s name now reveals that person’s home address and the product they requested or ordered.

To my knowledge, the company has not informed people affected by this error.

Technorati Tags: ,

Latest zero day attack in the wild

If you surf the web using Internet Explorer, here’s another reminder that you should consider switching browsers:

If you’re reading this with Internet Explorer on a Windows machine, don’t. The Windows animated cursor zero-day attack that was coming through on IE 6 and 7 running on fully patched Windows XP SP2 is now also hitting Windows 2000, Server 2003 and Vista. As F-Secure advises, better to use some other combination.

Proof-of-concept code for the attack was released after business hours on Friday, according to SANS.

Blocking .ani files won’t help. SANS has picked up reports of the vulnerability being exploited in the wild with .ani files renamed as JPEGs.

Microsoft today posted security advisory 935423 about the exploit. Here’s the full list of vulnerable systems:

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 2
Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
Microsoft Windows XP Professional x64 Edition
Microsoft Windows Server 2003
Microsoft Windows Server 2003 for Itanium-based Systems
Microsoft Windows Server 2003 Service Pack 1
Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
Microsoft Windows Server 2003 x64 Edition
Microsoft Windows Vista

The company still hasn’t provided a patch. The vulnerability is a candidate for inclusion in the CVE (Common Vulnerabilities and Exposures) list, having been assigned the label CVE-2007-0038 (previously also CVE-2007-1765).Although there currently is no official patch, a SANS handler has posted instructions on detecting and filtering out .ani file exploitation attempts. eEye provided a temporary patch, although the company recommends updating to Microsoft’s patch when it’s out.

That’s a pretty significant vulnerability, and there’s just not a way to deal with it in a manner that would leave me comfortable.  I highly recommend Mozilla or Opera for the Windows-bound, although you have to remember that no matter what browser you use, there will be vulnerabilities at times.  In this case, it’s a matter of reducing your exposure.

Technorati Tags: ,

Remember, all this security is only for your protection

Proving that our government continues to be incapable of protecting us, no matter how many rights or freedoms it strips away, we find that screeners at the Denver airport can identify a bomb only about 10% of the time, even when screening systems set off alarms. So, as almost always is the case, the human element breaks down. But then, that weakness of security has been known so long (and a shorter link to that article). The question is, how do we improve the weak link? I’m thinking hiring better people for the positions, training them better, cutting shift durations (repetition and boredom lead to reduced performance), and I’m sure other measures – all requiring more money.

Checkpoint security screeners at Denver International Airport last month failed to find liquid explosives packed in carry-on luggage and also improvised explosive devices, or IED’s, worn by undercover agents sources told 9NEWS.

“It really is concerning considering that we’re paying millions of dollars out of our budget to be secure in the airline industry,” said passenger Mark Butler who has had two Army Swiss knives confiscated by screeners in the past. “Yet, we’re not any safer than we were before 9/11, in my opinion.”

The Transportation Security Administration (TSA) screeners failed most of the covert tests because of human error, sources told 9NEWS. Alarms went off on the machines, but sources said screeners violated TSA standard operating procedures and did not hand-search suspicious luggage, wand, or pat down the undercover agents.

“The good news is we have our own people probing and looking and examining the system,” said Rep. Ed Perlmutter, a Democrat in the 7th congressional who sits on the House Homeland Security and transportation committees. “The bad news is they’re finding weaknesses.”

Actually, the fact that they are finding weaknesses is also good news. Having the weaknesses is indeed bad news. Finding them means we can develop means of improving on them, which is a good thing. Still – I can no longer take my keychain Leatherman when I fly, because it has a 1 inch knife blade, but people who actually want to inflict harm have a 90% chance of getting their bombs on with them. Way to protect us, TSA and Homeland Security!

Technorati Tags:

Anandtech forumites discuss freeware security products

I’ve been a reader of the Anandtech forums for far longer than is reasonable. I typically lose interest in such communities and move on to others way sooner than I have this forum. While browsing the forums last night, I ran across this thread on freeware security tools. Given that Anand’s site is so techie oriented, the forums are loaded with very knowledgeable techs. This thread shows that, and has a lot of great information on choosing and using anti-virus, firewall, anti-spyware, and other security tools. If you aren’t set up with malware protection on your system, consider choosing a recommended product from each category in this thread.

For even more security information and guidance from the Anandtech forums, look at this consolidated malware solution thread. It greatly expands on the information from the above-linked free security tools thread. In fact, this 2nd thread is the discussion responsible for the 1st thread. And these folks really know their stuff.

Technorati Tags:

Security, the Mac, Mac users – fanatical devotion != secure

Last week, the BBC wrote on security on the Mac and the apparent attitude Mac users take towards security. Highlighting the “Month of Apple Bugs” (MOAB) project web site, the BBC discusses the security reality of Mac computing. I suppose due to the brevity of the article there isn’t a lot of the really good information on security I’d like to see, but the BBC basically showcases the reality of security the MOAB project revealed while still pointing out that ultimately, the Mac has yet to be hit by a big, nasty worm or virus like Linux, Windows, Solaris, and so many operating systems have.

Apple Mac users are still too lax when it comes to security matters, an independent researcher has said.

Kevin Finisterre caused ripples in the Mac community when he started a website in January revealing a different bug in Apple systems each day of the month.

While some observers dismissed the survey, Apple recently issued a patch to plug holes outlined by Finisterre.

Apple owners’ attitude to security was “one of the main reasons we started the campaign,” he said.

Apple makes great play of the fact that its OSX operating has yet to be attacked by a virus while Windows XP machines are plagued with problems.

In the end, real-life commitments prevent the MOAB project creator from continuing regular work on it. He does note, however, that he would be glad to continue working on it if someone could put up the capital required to keep it going.

Technorati Tags: ,

Next-gen video discs fully cracked

Not long ago, there was news of a successful crack of Blu-Ray and Hi-def DVD copy protection, but it wasn’t a general crack.  The crack relied on a weakness in extracting decryption information from discs, but it was a non-trivial effort.  The new method builds on that to successfully break any AACS protected disc.

As I can understand some of you are interested in how I retrieved the Media and Processing Keys. I will tell what i did.

Most of the time I spend studying the AACS papers. A good understanding of how things worked have helped me greatly in knowing what to find in the first place (and how to recognize something). I may write an explanation of (my understanding) of how AACS works in particular the subset-difference technique (which is by far the hardest to understand) at a later date if you guys want to.

But anyway. Since the moment I found the Volume ID (which was much simpler than I had thought) my thought was to try to find the Media Key. But after some discussion I thought it might be better to go directly for the Device Keys (bad mistake). After looking at files created and changed by software player and trying to recognize Device Keys in memory dumps I was starting to get worried a bit. I wasn’t making any progress.

So I went back to my original idea: do a bottom-up approach. So first I tried to find the Media Key. One of the logical things to do even before that was to search for the Verify Media Key Record in memory. But it wasn’t there. I then started to work on a little proggy that would scan a memdump and see everything as a Media Key: thus trying to verify it with the Verify Media Key Record. No luck.

This was frustrating: all kinds of information was in the memdump but not the Media Key (I sort of assumed/hoped it would). I made several memdumps at different moments but nada, nothing. After throwing it all away I remembered I still had a “corrupt” memdump from WinHex (it failed to finish it because WinHex said the memory had changed). It was really small compared to the others so I didn’t have much hope. But when running it with my proggy: voila! I found it. Which finally gave me hope I was going in the right direction.

There were just two major problems left: how do you detect the Processing Key and if its not in memory how do you find it at all? Well since I now knew how things worked I knew the Processing Key had to be combined with a C-value to produce the Media Key.

OK, I don’t get any of that.  But clearly others do, so I share this for their benefit.  (via boingboing)

Technorati Tags: ,

Beware unknown Excel spreadsheets

Microsoft has announced that there is, unfortunately, another currently unpatched exploit in Excel.

In its security bulletin, Microsoft warned that “other Office applications are potentially vulnerable” to the zero-day flaw.

Zero-day refers to a flaw for which there is an exploit but no available fix. The Excel vulnerability is Microsoft’s fifth zero-day exploit since December, and part of an increasingly troubling trend.

The zero-day flaw affects Office versions 2000, XP, 2003 and 2004 for the Mac, but not 2007 or Works 2004, 2005 or 2006.

That means don’t open any Excel spreadsheets that you don’t know and trust the source if you are using any of the vulnerable versions.  In related news – if you aren’t already aware, there is a similarly troublesome exploit available for Microsoft Word.  While it is fun to pick on Microsoft, note that this problem is a nearly unavoidable result of increasingly complex software.  Even some of the best known security software and networking tools have had security vulnerabilities in the past.

Technorati Tags: , ,

An easy way to steal identities online

Catching up with my online reading a bit tonight, I found a link to a site which will check if your social security number is in their database of known stolen SSNs. I’ll not link to the site directly, because I want to save any of the less intelligent web users who accidentally find me site from doing something not-very-bright (I know both the regular readers of my site are so astonishingly above average intellect that not only would they not fall for this, they can actually read the mind of criminals attempting to steal their SSNs). All you have to do to see if you are in this stolen SSN database is enter your SSN into the handy-dandy search field. This news is a couple of days old already from the DownloadSquad folks, and thankfully there are a number of commenters there who have already pointed out the problem with this service.

So where did they get their data from? Well from the FAQ on their site, here is their response. “The information that powers StolenID Search is found online, by looking in places where fraudsters typically trade or store this kind of information. All information behind StolenID search is publicly available, but not in places where search engines such as Yahoo and Google would look. TrustedID abides by all state and federal laws in the collection and provision of this compromised information. The information behind StolenID Search comes from collection efforts led by TrustedID directly and also from other reputable companies that assist us in finding this information on our behalf. One of those companies is Cyvellience.”

Note that I am not saying StolenID Search is a web site operated by evil ub3r hackers. I am not saying you can’t trust the folks holding this information to protect the information you enter or the information they already have. I’m not even saying you will be exposed to any actual risk of identity theft if you use the site. I’m pointing this site out and warning against using it because giving out this information online just isn’t something you should ever do when you can avoid it. If you ever see something like this, please think carefully about what risk you are taking sending this information to people unknown. The site seems to have the recommendation of some seemingly trustworthy security and privacy resources. The site may be run by the most trustworthy people in the universe, and a chorus of angels may accompany everyone associated with the site to protect them from ever suffering ill. That still doesn’t make me feel I should send them my SSN.

Technorati Tags: ,

Windows Vista – vulnerable already (permanent activation hack, too)

Well, normal consumers haven’t even received the product and we find industrious types working to show us security flaws in Windows Vista. This should surprise no one, but I guess it does, or news of it wouldn’t be such a big deal. “Complexity = insecurity” generally. Vista is an extremely complex system. There will be lots of security flaws discovered. It is unfortunate, but likely unavoidable in software the size of the latest Microsoft OS release. And yet, here I am posting about it.

Microsoft is facing an early crisis of confidence in the quality of its Windows Vista operating system as computer security researchers and hackers have begun to find potentially serious flaws in the system that was released to corporate customers late last month.

On Dec. 15, a Russian programmer posted a description of a flaw that makes it possible to increase a user’s privileges on all of the company’s recent operating systems, including Vista. And over the weekend a Silicon Valley computer security firm said it had notified Microsoft that it had also found that flaw, as well as five other vulnerabilities, including one serious error in the software code underlying the company’s new Internet Explorer 7 browser.

In a separate article, elsewhere on the gr3at int4rweb, we find that there is already a permanent activation hack for Windows Vista, too. This allows you to avoid the “must activate within 14 days or functionality will be reduced” problems.

Until now, Microsoft has an upper hand, with no permanent or foolproof ways to crack or bypass Windows Vista activation request emerged. Instead, various workarounds and tricks to bypass, skip, delay, disable or spoof Vista activation has been suggestion, to various degree of success, such as extend evaluation period, rearm method, install Vista in future year, ‘frankenbuild’ Vista by replacing RTM build WPA files with RC build files, activate against spoofed KMS server, or run and activate Vista with own local KMS server and etc. Now, there is new crack method that able to permanently stop the countdown timer of time left to activate Windows Vista, effectively running Vista OS in full functionality evaluation mode forever.

Technorati Tags: ,