Kudos to Microsoft

According to this TechWeb story, Microsoft is denying access to MSN Messenger clients older than version 6.2.0205. This is a response to Core Security's advisory, which Microsoft followed with MS05-009. A malformed buddy image could exploit a vulnerable user's instant messaging (IM) client. Microsoft even posted a dedicated page explaining the problem to IM users.

This is the first time I recall a vendor (at least Microsoft) denying access to a service because a user is running vulnerable software. This would be like refusing to let a person browse the Web because their version of Internet Explorer is too old, or refusing to let them check mail because Outlook is out-of-date. This is a form of "network addmission control" (Cisco-speak) or "network access protection" (Microsoft-speak) taken to a whole new level. I hope to see more of this in the future. Of course, I would prefer all of this to be transparent to users who don't care. I would much rather have everyday email- and Web-checking users running centrally managed thin clients.

Update: According to this Microsoft Security Response Center Blog entry, "all 150 million MSN Messenger users worldwide are now updated and no longer subject to exploitation from this vulnerability. It was a big decision to make the upgrade mandatory in such a short period of time, but we collectively decided that the small inconvenience of having customers upgrade was the right thing to do to help protect them."

Read More

ChoicePoint Information Theft: An Omen

I read at MSNBC that 30,000 - 35,000 California residents were warned that "unauthorized third parties" may have accessed their personal information, such as their names, addresses, Social Security numbers, credit reports and other information. The data was stolen from ChoicePoint, an Atlanta-based firm that describes itself as "a trusted source and leading provider of decision-making information that helps reduce fraud and mitigate risk. ChoicePoint has grown from the nation's premier source of data to the insurance industry into the premier provider of decision-making intelligence to businesses and government."

ChoicePoint claims the data was stolen through 50 fake companies that were set up to access the data. MSNBC says "The incident was discovered in October, when ChoicePoint was contacted by a law enforcement agency investigating an identity theft crime. In that incident, suspects had posed as a ChoicePoint client to gain access to the firm's rich consumer databases."

MSNBC also reports that ChoicePoint "says it has 10 billion records on individuals and businesses, and sells data to 40 percent of the nation's top 1,000 companies. It also has contracts with 35 government agencies, including several law enforcement agencies."

This is the same ChoicePoint that MSNBC profiled last month. In that story company vice president James A. Zimbardi said "We do act as an intelligence agency, gathering data, applying analytics."

If this private intelligence agency is going to collect and publish my personal information, it better be held to a high standard. I bet that California residents aren't the only Americans affected by this incident. I have no insider information but I expect to hear more details in the future.

This story comes on the heels of a Washington Post report that government contractor SAIC suffered a physical break-in at a San Diego facility on 25 January 2005. Thiefs stole computers "containing the Social Security numbers and other personal information about tens of thousands of past and present company employees." Aside from this buried announcement, the reason we know of this intrusion is the California law requiring disclosure to those affected. In SAIC's case, that is 45,000 current and former employees.

Both of these incidents indicate that California's disclosure law needs to be expanded to the Federal level. How many other organizations are leaking personal data without our knowledge?

These two cases also demonstrate my security mantra that prevention eventually fails. Therefore, we need to have robust detection and response mechanisms in place. The best detection mechanism for an individual may be a service that provides access to your credit report (for a fee). This allows you to monitor access to your credit report and spot potentially fraudulent activity. Consumers in certain western US states are already entitled to an annual free credit report from each of the three credit bureaus. Check this Federal Trade Commission site for more details. It looks like those of us in the northeast will have to wait until 1 September 2005.

Once available, however, it looks like one could order one credit report from each bureau per year. It might be a good strategy to order one from Experian in, say, January, another from Equifax in May, and the third from TransUnion in September. The following year, repeat the cycle, in the same order. This strategy provides a look at your credit report every four months, as opposed to once per year.

The only response strategy is to follow the Federal Trade Commission's identity theft advice.

Read More

Review of Google Hacking for Penetration Testers Posted

Amazon.com just posted my five star review of Google Hacking for Penetration Testers. In short, this book rocks. From the review:

"'Google Hacking for Penetration Testers' (GHFPT) should be a wake-up call for organizations that consider 'information leakage' a theoretical problem. 'Information leakage' refers to the unintentional disclosure of sensitive information to public forums, like the Web. Security staff can use the tools and techniques outlined in Johnny Long's GHFPT to assess the degree of information leakage affecting their organizations. They can then propose, implement, and test remedies. When Google says they are clean, they can be reasonably assured they are."

I recommend visiting the author's site at johnny.ihackstuff.com to download his Shmoocon slides. They are a good overview of the book.

Read More

Pre-Reviews: On Bejtlich's Bookshelf

Many publishers have been kind enough to send review copies of interesting books. I am especially grateful when publishers send books I definitely plan to read. Unfortunately, in some cases the time between my receipt of the book and my Amazon.com review is longer than I would like. The purpose of this blog entry is to let you know of the great books I have waiting on my bookshelf. They are the same ones listed on my reading list. As I receive books on my Amazon.com Wish List, I'll pre-review those as well.

First up is Beginning Perl, 2nd Ed by James Lee and published by Apress. James also co-wrote Hacking Linux Exposed, 2nd Ed, which I enjoyed. I do not plan to read this book and become a Perl guru. Instead, I hope to become familiar enough with Perl to understand applications that use the langauge. Oinkmaster, the Snort rules update script, is one example.

My plan to start seriously learning Python begins with Practical Python by Magnus Lie Hetland and published by Apress. I gained an introduction to Python when I read Learning Python, 2nd Ed by Mark Lutz. Two subjects which were never really addressed in that book, however, were accepting user input and network programming. I hope this Python book and those that follow help me to put Python to work.

My next Python book is Dive Into Python by Mark Pilgrim and published by Apress. This book expects readers to have some knowledge of programming, so there is less hand-holding than an introductory book might have. I am reading this and other Python books because the language seems like a good way to accomplish programming tasks that don't require the low-level bit handling power of C.

My last Python reference is Foundations of Python Network Programming by John Goerzen and also published by Apress. By now you should see I think Apress is bringing a lot of helpful programming texts to the world. I intend to read this book to learn how to write client-server networking programs.

My last book on interpreted languages is Practical Programming in Tcl and Tk, 4th Ed by Brent Welch, Ken Jones, and Jeffrey Hobbs, and published by PHPTR. I'd like to gain some familiarity with Tcl/Tk because it's the language in which Sguil is written. I would like to contribute more to Sguil than the few modifications I've already submitted.



Next is Beginning C, 3rd Ed by Ivor Horton and published by Apress. C is everywhere, from operating systems to security applications like Snort. As with Perl, I don't expect to read this book and become a C wizard. I already gained a passing familiarity with C by reading Stephen Prata's C Primer Plus, 4th Ed. I hope to read this new C book and improve my ability to understand other people's C, and perhaps make tweaks if needed.

I have similar hopes for Practical C Programming, 3rd Ed by Steve Oualline and published by O'Reilly. I actually started to read this book before any other book on C. I became frustrated when I found some of the exercises required knowledge of programming topics not yet introduced in the book. With a little more C understanding, I think I could complete the exercises and gain additional insights into C.

If you thought learning C would be tough, try a book on assembly like Professional Assembly Language by Richard Blum and published by Wrox, a Wiley imprint. I am definitely not reading this book to become an assembly programmer. I am also not reading the book to modify assembly produced by the compiler, as is the stated goal of the text. Rather, I frequently encounter assembly when looking at exploit code. I would like to be able to follow what the code is doing, and thereby improve my understanding of the enemy's capabilities.

The next series of books builds upon the programming knowledge gained from the previous titles. I start with Exploiting Software by Greg Hoglund and Gary McGraw, published by Addison-Wesley. This is a very popular book, but I have held off reading it until I have the necessary programming background to really appreciate it. This is in some ways the second book in a series on security programming; the first was Building Secure Software.

The next book in the attacking software category is Buffer Overflow Attacks by James C. Foster, et al, published by Syngress. I find it interesting to see an entire book devoted to this class of attack. I am looking forward to gaining a good understanding of this sort of exploit. The book features several strong contributing authors.

My last book on attacking software is the very popular Shellcoder's Handbook by Jack Koziol, et al, published by Wiley. This book is similar to Exploiting Software; I prefer not to read it until I have a better understanding of C and assembly. This book featured a number of zero-day attacks that were not fixed until after the book's publication.

I plan to move from attacking software to defending it by reading Writing Secure Code, 2nd Ed by Michael Howard and David C. LeBlanc, published by Microsoft Press. If anyone needs to read this book, it is certainly Microsoft. Whereas Building Secure Code was more UNIX-oriented, this book supposedly addressed Windows vulnerabilities.

I plan to temporarily leave the security world behind once I start reading the Pocket Guide to TCP/IP Sockets (C Version) by Michael J. Donahoo and Kenneth L. Calvert, published by Morgan Kaufmann. This is a short book, but it provides an introduction to socket programming in C. The authors assume some command of C, so my earlier reading should prepare me.

Next I hope to read Understanding UNIX/LINUX Programming: A Guide to Theory and Practice by Bruce Molay, published by PHPTR. I would like to gain a general appreciation for programming in the UNIX environment when reading this book. I am not planning to hack any kernels or userland applications, but I want to know more about what is happening under the hood of my UNIX systems.

The next book is one that some people thought might never be published. It's Unix Network Programming, Vol. 1: The Sockets Networking API, 3rd Ed, by the late W. Richard Stevens, and updated by Bill Fenner and Andrew M. Rudoff, published by Addison-Wesley. When Richard Stevens passed away in late 1999, the world lost an exceptionally talented author and person. This book is an update to his 2nd edition, and I look forward to reading it.

The last book waiting to be read on my bookshelf is BSD Sockets Programming from a Multi-Language Perspective by M. Tim Jones, published by Charles River Media. I think this is a good way to end my programming reading, because it shows how to accomplish network programming tasks in a comparative manner. Jones covers socket programming in C, Java, Ruby, Perl, Python, and Tcl. While I will not have any Java or Ruby experience, I expect to learn a lot by comparing the various approaches for the languages with which I am somewhat familiar.

I have other unread books on my shelf, but these are the ones I currently possess and plan to read. My Amazon.com Wish List shows over 30 other titles I hope to acquire in the coming months (or probably years). At some point I will integrate them into my upcoming reading list, or just do individual pre-reviews as I acquire them. Stay tuned. :)

Read More

Updated Sguil 0.5.3 Installation Guide Posted

I just posted an updated Sguil Installation Guide. The previous edition was slightly out-of-sync with the directory conventions introduced in Sguil 0.5.3. I also was careful to account for actions required when installing separate sensor, database, and sguild server components. The new guide does not yet describe installing Snort or Barnyard on FreeBSD using the ports tree. Once Paul Schmehl finishes his work on Sguil ports, I will redo the guide to try a ports-only installation. I may wait for Sguil 0.6.0, however, depending on when Bamm expects to release it.

Read More

Thoughts on MCI Acquisition of NetSec

I only recently learned that telecom giant MCI bought managed security services provider NetSec for $105 million. Other telecom companies might want to look at Lisa Phifer's Managed Security Service Provider Survey or Adam Stone's In MSSPs We Trust for acquisition candidates. I expect acquisitions to continue, as there are between one and two dozen small MSSPs available. There are also people like myself who know how to build MSSPs from the ground up (hint hint). :)

Update: It must be confusing to work for NetSec. One minute you're working for MCI, the next you're working for Verizon!

Read More

Two Questions for Readers

I have two questions for readers:

1. What is the cheapest switch you've found that offers a SPAN port?

2. Is anyone interested in writing a chapter providing an overview of peer-to-peer protocols? I have been unable to contact the subject matter expert I hoped to contribute this section to my new book. I am looking for someone with experience detecting, interpreting, and controlling peer-to-peer protocols on internal networks. I am interested in providing the reader the following:

- Overview of general p2p principles and networks
- Discussion of popular p2p implementations
-- Networks and clients
-- General analysis of packet traces via Ethereal or Tethereal or Tcpdump captures (save captures for inclusion in book, if possible)
- Ways to detect p2p activity
- Ways to control (but not eliminate) p2p on internal networks; in other words, allow BitTorrent for downloading .iso's, but don't let it consume too much bandwidth
- Other topics you find relevant and interesting

I recommend responding via comment for the first question, and emailing taosecurity at gmail dot com for the second. I've just sent an email to the guys at Slyck.com to see if they'd like to help.

Update: I found this listing of switches reportedly offering mirror ports at Colasoft.

Read More