Angels of security » general

predictions for 2011

admin — Mon, 27 Dec 2010 20:55:22 +0000

With everyone else doing their predictions for 2011, I figured I should get in the game and make some of my own. To save time in advance, I’m also making these my predictions for 2012.

The prefix ‘cyber’ will continue to be greatly overused by the non-technical, especially the media.
Something (malware, infiltration, data breach), will occur that will be declared the most complex/dangerous/expensive of all time.
Infosec professionals will continue to complain about how bad a cert the CISSP is.
Infosec professionals will continue to obtain CISSP certifications en-masse.
Some new wicked-cool feature, toy, or tool will be released that everyone in the world will want. Security people will try to warn the public of the risks this new device poses, and will have no impact on the new device’s adoption or sales.
‘Privacy experts’ will continue to warn the public and gain media attention, and the public will continue to ignore them.
Users will continue to choose weak passwords, and we’ll pretend that this shocks us.
OWASP will continue to be awesome.
We will continue to be hampered by lack of information, and unbridled complexity, and will somehow manage to do our jobs anyway.
The earth will continue on it’s orbit around, water will be wet, summer will be hotter than winter, babies will be born, people will die, taxes will always be too high, and next year we’ll do it all again. Have a great 2011!

Seen at OWASP appsec dc

admin — Tue, 09 Nov 2010 01:21:59 +0000

Seen at OWASP appsec dc

Originally uploaded by bachrach44

This sign pretty much speaks for itself. Something about the very specific and non-legalistic warning message really speaks to me.

OWASP USA conference videos

admin — Thu, 14 Oct 2010 00:50:14 +0000

OWASP has uploaded a whole bunch of videos of the talks given at AppSec USA 2010 in Irving CA in early September. There are some very good talks in there by some very good people.

On a related note, I’m going to be talking at AppSecDC in November on Domino security. Come check it out.

Spaming to find goods launderers

admin — Tue, 14 Sep 2010 16:35:24 +0000

I got a spam this morning which is essentially looking for people to help repackage and ship out stolen goods. They have of course dressed it up in an attempt to appear legitimate, but anyone with any sense can tell this is a scam. I thought briefly about pretending to accept long enough to get some info on the perps and then turn the info over to the authorities, but I highly doubt anyone will actually care. I’m still surprised by their brazenness.

Hello, my name is Lawrence Siegell. [note: email sent from Evan Franklin]
I’ve just viewed your resume and would like to offer you a part-time job based on work at home.
Our company name is Manpower East Gmbh. Job title is Stuff Manager.

We’re a small courier company based in Europe.
We help our clients to order some goods or things at low prices and safety ship packages to the client side.
Our experience shows it’s easier to order something using our service.
We’re looking for a good support representative to process our packages in the USA.

The stuff (like clothes, musical instruments) will be shipped from the online stores, auctions or some of warehouses via regular or express delivery services like USPS, UPS and etc. You will have to handle these packages and resend it to us or our couriers.
Your salary will be $20 USD for each handled package but you will get $50 USD for each package, marked as important. Of course, you will have some bonuses if you work hard and complete your tasks in time.
You will receive 5-20 parcels weekly, trial period (first 4 weeks) includes processing of 2-5 packages.
Maximum packages weight is 20lbs, max size lenght+width+height < 80 inch, usially 5-12lbs, 8*14*18 inch. For heavy parcels you will be paid with additional (bonus) salary.
We pay monthly or per 20 sent packages. If you have PayPal account, you will be paid via PayPal instant transfer, if don’t have then via Western Union or Moneygram.

All shipping charges will be paid by our company.
No investments required, we will cover all your expenses including shipping charges.
If you’re interested in our offer give me your contact phone # and the best time to reach you at. Or contact me via email.
I also want to inform you that sometimes the international calls from Germany have no caller ID that’s why I ask you to answer the unknown phone calls.

Best regards,
Lawrence

update: Since a lot of people seem to be finding this page, I figured I would add a link to this article from workathomescams.com which describes how the scam works, and mentions that if you participate, you may find yourself to be an accessory to a crime.

email attachments

admin — Wed, 28 Jul 2010 20:40:49 +0000

I just got a spam email from a company trying to sell me something-or-other for email that included the following quote:

“Most organizations are struggling with the rising tide of email attachments, which can rapidly consume all available email storage when left unchecked.”

They attributed this quote to Matthew Cain, which I can’t verify, but my only response is: Really? I mean really? In this day and age? Are you sure this quote isn’t from…. 19992?

no such thing as cyber-terrorism

admin — Fri, 02 Apr 2010 19:22:20 +0000

Since the terrorist attacks of September 11 2001, a lot of money has been spent on fighting terrorism. People who want money, whether for their department budgets, federal grants, or to fund startups, have been casting themselves as terrorist fighters. It has simply become to word du-jour. In the information security field, one of the outgrowths of this is the complete and utter overuse of the phrase cyber-terrorism. Admittedly I saw a lot more of this when I was in government circles than I do now in the private sector, so I suppose this is a “leftover rant”, but it is also intermittently popular in the media. Let me say loud and clear: cyber-terrorism does not exist – now, or ever. (Cyber-warfare is a more complex issue which I’ll deal with in another post).

I remember one government run conference I was at where almost half the talks focused on cyber-terrorism in some way. About halfway through the conference I cornered an academic friend of mine and asked him if he had ever, in his entire life, heard of even a single case of cyber-terrorism. After a few moments of thought the best he could come up with was that if a terrorist was very good, they would have infiltrated something and would be biding their time and waiting. Although this is a popular story amongst fear-mongers, it is not how terrorists work. The goal of terrorism is to wage a campaign of terror. To do so you take credit for everything you do in order to make your targets feel like you control the situation and not them. In fact, terrorists frequently try to take credit for things they didn’t do, just to assert themselves as being in control. Their goal is to gain attention – not avoid it. A terrorist wants to get on the front page of every newspaper in the world – they don’t even care if they killed anyone or blew anything up. (See for example the fact that Umar Abdulmutallab, better known as the Christmas day bomber, is being hailed as a hero even though his plan failed!) For the terrorists the Abdulmutallab attempt was a success not because it killed people or caused damage, but simply because it got us Americans to panic – they inflicted terror. Computer hacking simply doesn’t elicit the same response. The Chinese-Google hacking case arguably caused more damage, but it did not elicit the same fearful response from the American population. It was also almost certainly a much larger expenditure of resources. Why would any terrorist group expend ten times the resources for one-tenth the result? (Again, using their definition of the word result). Cyber-terrorists may make good movies, but they simply don’t exist in real life.

Nigerian scammers go up a notch

admin — Tue, 20 Oct 2009 15:51:26 +0000

It always amazes me that:

1 – people assume that because something is written down it must be true.

2 – disreputable people will always find new and creative ways to take advantage of the above.

Courtesy of Emails from crazy people (and further variants on snopes) comes the newest evolution of the Nigerian 419 scam. Absolutely astounding.

I want you to read this message very carefully, and keep its content secret till further notice, you have no need of knowing who I am, where am from, till I make out a space for us to see, I have been paid $50,000.00 in advance to terminate your existence with some reasons not listed in my contract by my employer, this employer is one you may call family, I have been in close surveillance for one week and three days now and have seen that you may be innocent, which really is not for me to decide.

Note that for your safety do not think of contacting the police or F.B.I or try to send a copy of the message to them, because seeing an alert on this massage will force me to do what I do not intend doing (Believe me it will seem like an accident to even the F.B.I forensics) As this is the first time am betraying a client.I will be needing a retirement fee from you to return to my country ASAP as I can not stay any longer in your country after this.

Now, listen very carefully I will arrange a location for you to pick up tapes and pics of me and my employer for court evidence, and also meet with you face to face if you promise you won’t involve the police or F.B.I. Contact this email within 48hrs as I do not have much time. *****@yahoo.

Be careful of who you think you are showing this massage to, we are watching and listening to every move you make.

You don’t need my phone contact for now till am assured you are ready to comply good.

no more free bugs

admin — Thu, 02 Apr 2009 20:28:38 +0000

A very interesting development in the disclosure debate.

A few weeks ago, Charlie Miller, Alex Sotirov, and I [Dai Zovi] arrived on a new meme: No More Free Bugs.

Therefore, reporting vulnerabilities for free without any legal agreements in place is risky volunteer work. There are a number of legitimate alternatives to the risky proposition of volunteering free vulnerabilities and I have already mentioned a few (I don’t want to turn this into an advertisement or discussion on the best/proper way to monetize security research). There just need to be more legal and transparent options for monetizing security research. This would provide a fair market value for a researcher’s findings and incentivize more researchers to find and report vulnerabilities to these organizations.

7 habits of highly effective infosec profesionals

admin — Mon, 09 Mar 2009 15:31:51 +0000

In his book 7 habits of highly effective people, Steven Covey describes presents universal habits which can be applied to any person, organization, profession, corporation, or business. As part of habit 3, “put first things first”, he describes a way to classify activities in terms of importance and urgency . He has a basic four box matrix that looks like this:

	Urgent	Not urgent
Important	I (crisis)	II (Prevention)
Not important	III	IV

His point is that too many people spend too much time in box I, which is the crisis box. Crises, in his words, “act on you, rather than you acting on it”. The solution he says is to spend more time in box II – things which are important but not urgent. To give a brief example, if you were suffering a heart attack and needed medical attention, that would constitute a box I event – it is both urgent and important. A box II event would be exercise and proper diet, which would ultimately reduce your likelihood of having the heart attack in the first place. By working more in box II, you ultimately shrink the amount of time you spend in box I. Security is, almost by definition, a box II item – it is important, but rarely urgent. However within our profession this matrix can still be applied, and I think that properly classifying and thinking about these activities can greatly help an infosec individual or group better prioritize it’s activities.

	Urgent	Not urgent
Important	Incident detection, Incident containment Incident eradication Deploying urgent patches because the newest worm is tearing you apart	Security reviews Hardening systems Deploying secure technologies like DNSSec, VPNs, SPF, DKIM, etc. code review Implementing a good patch management policy User awareness training
Not important	Regulatory compliance Complying with legal requests/issues	Playing solitaire

I’m clearly not saying that you should all start to simply ignore the crises that regularly crop up in your line of work, however I think that entities which focus on box II items will ultimately see far more benefit than those that ignore those things (as they’re not urgent), and will end up spending all their time in box I.

security and outsourcing

admin — Fri, 06 Mar 2009 20:36:00 +0000

Chris Wysopal has a good article in securityfocus about security reviews of outsourced software. I must admit I agree with just about everything he said (that you need to do due dilligence on the code that was outsourced, just like you do for internally developed code). However, there is one factor missing from the article. The reason so much development is outsourced these days is because companies don’t want the hassle/cost/overhead associated with doing their own development. Security is included in that. If a company doesn’t want to go through the hassle of hiring their own developers and doing QC on their own code, what makes you think they’re willing to hire security experts to do QC on the code they outsource?

Although there are many solutions, including having a third party review built into the outsourcing contract, one obvious solution that comes to mind is having third party certifications, similar to the common criteria or DITSCAP.