The Game Is Not Over -- Security for your web site

1. Man-in-the-middle (MITM) attack against SSL plus Sitekey/Passmark – The Stop-Phishing Research Group at Indiana University demonstrates that if you are not very careful about the URL and the SSL certificate, and most people are not, the attacker will be successful
2. Sniffing a connection to steal session cookies to bypass user authentication – Robert Graham of ErrataSec, has demonstrated why you need a security barrier for your laptop at Starbucks (If his name for this attack sticks "side-jacking" then we might as well all give up and start referring to SSL as a condom for your browser)
   
3. If you think you don’t have to worry about these exploit techniques, then you better have the Security Excuse bingo card (found on Schneier on Security),
   

It looks pretty bad. SSL can be bypassed, authentication cookies can be stolen. If you follow the blogosphere’s impression of the recent Blackhat/Defcon events, it's all useless and there is nothing we can do to stop the crooks. To top it all off, there isn’t just one Hackistan (great Yak snacks by the way) there are many Hackistan’s and no web site is to small or broad-band connected PC to innocent for them to exploit.

Truth is, if a malicious hacker with the capabilities of a Grossman, Skoudis or Moore is after your site, then you will get hacked. Lucky for you these guys are busy™.

Solutions? Focus on your business needs and take some precautionary steps:

• Run traditional vulnerability scans (because Skoudis and Moore teach us that the old problems are new again)
  
  
• Run a web application scanner and use a secure coding inspection tool, Grossman and Zorkul are better, but it’s foolish not to automate everything you can
  
  
• Use SSL from start to finish on your web-site, you have an obligation to protect the integrity and security of all the data exchanged between your site and your customer’s browser – otherwise your giving it away to any crook with a copycat access point or a promiscuous wireless card
  
  
• Don’t ignore MITM because you think it is hard, it gets easier to do every day – Lucky for all of us, it’s also getting easier to protect against and detect MITM, Pharming, Highjack and Malware Injection, I know someone who can help
  
  
• Last but not least, plan on getting hacked, have an incident response plan and be prepared, playing security excuse bingo is a losing strategy

Get started today!

Disregard any pop-up security windows you receive

I received this in my mail today:

Dear Electronic Crimes Task Force Member,

CSO magazine is conducting a survey in cooperation with the U.S. Secret Service and CERT Coordination Center, the 2007 eCrime Watch. The purpose of this project is to uncover electronic crime trends.

CSO magazine’s sister company, IDG Research Services, has been commissioned to help us collect your feedback. Please click on the following URL to begin the survey or copy and paste the URL into your browser:

https://url-hidden

Disregard any pop-up security windows you receive. (Emphasis mine)

Please be assured that any information you provide is confidential and your responses will be used only in combination with those of other survey respondents. This survey should take no more than 10 minutes of your time. If you have any questions about this survey please contact IDG Research Services at ------@idg.com or ATSAIC ----------, USSS, San Francisco Field Office 415/-------.

Thank you in advance for your help.

Of course my first thought, was that this was a phishing attack. I couldn't imagine CSO and the ECTF telling me to "Disregard any pop-up security windows you receive."

Imagine my surprise and relief, when I went to the site and there were no warnings. So, they got it right, the SSL certificate was correct and unexpired ... but everyone is so accustomed to that not being the case, that as a matter of course they included the disregard pop-ups message. Is our infrastructure broken or what?

Virtually Secure

Christofer Hoff has a good post here. In particular,

Combine that with NAC agents on the hosts and...whether or not it actually works is neither here nor there. They told they story and here it is. It's good to be king.

His point being that Cisco doesn't have to worry about when they are going to deliver a product or even how will it will work when they do ...

Meanwhile, back in your virtualized data center, you can be warm and happy knowing that Cisco's virtually shipping product has you virtually secure already. Nice, huh?

What about Real Security -- Real Security for Virtualized Infrastructures? You've deployed half a dozen quad-core systems and thrown out 150 obsolete boxes. Maybe you had IPS and NAC in your datacenter already, but do you have it now? If your virtual windows 2000 server get's infected and starts attacking the other systems on the host, how will you know?

Maybe you will know when the infection begins to spread to other hosts and their virtual servers, but by then you will have a real mess on your hands.

The right answer involves doing something today, not waiting for a vendor to implement a solution next year. Here is the pragmatic prescription for today, virtual servers are servers, period.

If there reliability and security are important to your business then you have to secure them with same mature IT processes that you use for everything else:

1. Specify the appropriate security requirements at the start
2. Determine and implement secure baselines that meet your business and security requirements
3. Validate/test that the performance and security of your systems meets the stated requirements before you put them in production
4. After deployment, test them again -- virtualization really helps you here
5. Use change control and segregation of duties -- (ITIL and ISO 17799 driven) processes and controls to keep working systems, working
6. Patch management and vulnerability management are a continuous process -- don't treat these problems with a calender ... not unless you like emergencies
7. Continuously monitor your network and systems, use the protection appropriate to the value of the data or business operations, such as:
   
   • Gateway: firewall, anti-spam, anti-malware, content filtering, vpn ...
   • Network: vulnerability monitoring, IDS/IPS, NAC, Policy management and compliance ...
     
   • Endpoint: Anti-malware, AAA, log analysis, patching, encryption ...
     
   
   
8. Disaster/Business continuity planning, incident response and training have to include your virtual infrastructure -- DR/BP might be a big driver behind your virtualization effort, but nothing substitutes for a good test.
   

Do all of the above, appropriately to the level you need, don't wait to become the next security breach. It's more about the process than the tools.

I hate Passwords #10

From IP: link here

What I think needs to be done is that the public needs to be educated about these sites, and the security risk they pose.

The "public" is already being educated. We tell them over and over that they should not share their password with anyone. The problem is that the public gives up their password all too easily. We can keep blaming the public, and we will, but we should also try to understand why someone will give up their Yahoo (or other service) password easily, while the same person would never share their ATM PIN.

I think the public is pretty smart, but they learn best when they experience immediate consequences from their actions. Right now, I know that identity theft and losses from this behavior are at a tolerable level because most of the public are still willing to give their password away -- where the same public will never forgot to lock their car door at the shopping mall parking lot.

If the consequences (or at least people's awareness of these consequences) get a lot worse, we will either see a change in behavior or the deployment of technologies to eliminate reliance on passwords (tokens, client-side certificates ...).

Voting Software Security

Matt Blaze's group reviewed the Sequoia system's code. From his blog:

We found significant, deeply-rooted security weaknesses in all three vendors' software.

The problems we found in the code were far more pervasive, and much more easily exploitable, than I had ever imagined they would be.

Deliberate backdoors in these systems, if any existed, would be largely superfluous

My humble opinion: this is a great opportunity for the open source community to get together with the private sector (hello Fortify) to solve this problem.

Computer Market will keep growing

I learned a long time ago that no market grows fast forever....

Toni Sacconaghi, an analyst with Sanford C. Bernstein & Co., has chipped in on the gloom and doom scenario as well in a new research report.

"As the use of server virtualization rises, a negative impact on x86 server demand appears all but inevitable," he wrote. "While we still forecast positive x86 server unit growth in 2007 and 2008, our forecast calls for shipments to contract in 2009 and for growth to be about zero between 2007 and 2012, compared with historical double-digit gains."

This analysis varies from wrong, to really really wrong.

I agree with Ashlee Vance in the Register, virtualization is going to drive the demand for huge well-integrated multi-core systems, but there will still be plenty of need for ever more horsepower on the desktop and for dedicated blade or 1U system in the data center to feed specific CPU intensive applications.

I think we will eventually see desktop virtualization follow in the server virtualization footsteps, but when I look down the hall and see dedicated 4 core systems on people's desks, I find it hard to believe that we're going to see a sharp reduction in the growth of this market.