http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2009-11-25 03:27:04 - White Badger Group Blog : This article does a fantastic job of quantifying the somewhat nebulous idea of why end users generally tend to make decisions about security that seem poor Looking at the cost analysis comparing the price of end user time to the actual losses, it's clear that many of the basic traditional wisdoms surrounding daily web usage are a huge hassle with little payoff In other words, the average user would spend far more time attempting to maintain strong passwords and check every URL and SSL certificate than he she is likely to lose by failing to do so The article goes much deeper into the math leading to those conclusions, but it's not necessary to whip out a calculator to know he's right In my opinion, this solidifies the fact that much of the burden of end user protection is shifted up the chain While one user may only see a few pennies per year of realized risk, the organizations serving all of those end users will see substantially more loss, as it is all aggregated By the same token, organizations serving end users are in a position to much more economically deploy countermeasures, and have access to more data which allows them to do so effectively The other angle on this is that the more transparent security controls become to end users, the more effective they'll be This paper covers directly the effort needed to validate SSL and read URLs Other controls like virus scanning at the perimeter, IPS, and well-implemented least-access principal while not without issues of their own are considerably less likely to require end user effort to be effective, and therefore be a better answer in that regard than any amount of awareness training http://www.secuobs.com/revue/news/165001.shtmlhttp://www.secuobs.com/revue/news/165001.shtml Secuobs.com : 2009-11-05 21:45:27 - White Badger Group Blog - There have been numerous reports recently that a new Man-in-the-Middle attack has been developed which works on the previously secure SSL 30 and TLS 10 The details of exactly what can be done with this attack have yet to be fully explored, but the bigger point is what do you do now Well As I've declared many, many times before, you must assume that everything will be compromised at some point, so it should be planned for Since it's not likely that SSL 40 or whatever spec will prevent this new attack is going to be codified and deployable for some time, you have to have backup plans Realistically, there are two main things you can do as someone who uses SSL TLS to secure data in transit The first is you can do your part to be sure that there is no Man-in-the-Middle attack happening on your end of the connection While ISP-level man-in-the-middle attacks aren't impossible or even really difficult if you have access to a big enough line and BGP , they're certainly not common, so the last mile is what needs to be protected most On the server end, there's the issue of shared hosting Even when running on a dedicated piece of hardware, you will still be sharing a switch with other servers Any other rogue server on the same physical subnet is in a position to perform ARP poisoning or simple timing attacks on your data streams metasploitcom had this issue a while back Setting static ARP for the gateway is a good way to prevent that, but getting your servers in-house or in a reputable colo goes a long way as well On the client end, static ARP entries may not be a reasonable method due to a more static environment, but physically and electronically auditing your network to see what's attached is very doable Keep a healthy dose of paranoia about you when doing so, and be sure to keep the wifi locked down The second line of defense against this new attack is mostly in monitoring your environment and attempting to detect issues before they get out of hand The new SSL TLS attack itself is supposedly very hard to detect at the end points using current methods, as the attack deals in the re negotiation portion of the conversation, which isn't fully protected by the math that binds the certificates together So, detection needs to occur elsewhere Looking for abnormal protocol usage in the wrapped protocols or errors dealing with additional data would be a place to start Monitoring the applications and data being accessed would also likely show some trace of a successful attack Unfortunately, there's no single good defense which has been developed yet, so it's best to diversify your efforts Of course, you knew something like this would happen eventually, and all of these defenses and many more are already deployed, right - http://www.secuobs.com/revue/news/157923.shtmlhttp://www.secuobs.com/revue/news/157923.shtml Secuobs.com : 2009-06-17 21:55:26 - White Badger Group Blog - We are conducting a research survey about security breaches and needs Weare interested in your opinions Help us better understand how toassist you in making your organization as secure as it can be Foryour time you will receive a $500 voucher towards any of our testingservices Depending on the size of your network that could be a 50%discount Follow this link and answer 5 quick questions to claim yourrewardhttp://www.secuobs.com/revue/news/110892.shtmlhttp://www.secuobs.com/revue/news/110892.shtml Secuobs.com : 2009-04-03 12:30:52 - White Badger Group Blog - Many months ago, we started looking around for a platform on which tobuild our new Persistence™ service We were looking for something thathad scanning appliances which connect back over a secure tunnelSSL/SSH, certificate-based and have no listening ports With thisscheme, there would be no listening ports, and no obvious way toattack the boxes we deploy to client networks These appliances wouldalso need to have multiple interfaces VLAN and physical, because theappliances aren't exactly cheap, and I think it's just dumb to haveredundant hardware sucking electricity where it's not necessarySo, as many in the IT and security fields know, it's bad practice tohave any one device touching more than one network The exceptions tothis rule are usually security devices like firewalls and IDS sensors,all of which need to be specially hardened as any one vulnerabilitywould go against the point of having multiple networks to separategroups of devices In the process of evaluating devices from all thetop vendors in the arena, I set up a test network on which to run eachof the platforms As part of this testing, I wanted to be sure thatstraddling a firewall and connecting to several network segmentswouldn't be an issue As it turns out, one of the boxes I tested hadan issue As I'm under NDAs with pretty much every company I dealtwith, I'm not going to comment on which product had the issue I havebeen told that a patch is on its way and will hit in several weeksThe device in which I found an issue did meet all of my criteria Ithad almost zero footprint on the network It communicated only inencrypted tunnels, which were outbound from the appliance only It hadno listening ports However, what I did find is that the deviceresponded to ICMP pings standard echo request/reply I can see wherethis functionality would be useful for the end users, but from thestandpoint of super-hardening, it should be disabled, or at least havean option to be disabledThe specific flaw I found was that the OS's kernel didn't performproper source checking on packets For example, if interface 1 is on10110/24, and interface 2 is on 10220/24, it should drop packetsclaiming to come from 10222 which arrive on interface 1, and viceversa Failing to do this, the device I was testing happily repliesback out the other interface Spoofing packets from both directionsallows us to set up an ICMP tunnel, over which we can move just aboutanything Unless the backbone is set up to detect excessive ICMPtraffic monitor port + IDS, or switch-based IDS, or if the trafficneeds to pass over standard security devices an upstreamfirewall/IDS/IPS/router, this would be pretty difficult to trackdown Most organizations I've been in do not have the infrastructureto watch for this kind of tunneling when it is used specifically tobypass the firewallThis attack isn't exactly l33t or hardcore, it's quite basic It'sunfortunate that some of the basics do get missed when most attentionis paid to higher level attacks and other threats, but it does happenquite often Fortunately, the vendor had an excellent response interms of time and quality, and hopefully will give me many discountsin the future for doing some QA work for them ;-http://www.secuobs.com/revue/news/78796.shtmlhttp://www.secuobs.com/revue/news/78796.shtml Secuobs.com : 2009-04-03 12:30:52 - White Badger Group Blog - You might have noticed our new web site and its central flash animationAt the conclusion of each round of frames, we declare the following:Compliance is just the beginningKnow your enemy Know your weaknesses Have a planBehind these seemingly simple statements lies a lot of thoughtFirstly, we talk about compliance By definition, compliance meansthat you comply with standards These standards are set up as a bareminimum operating level for any given industry so that all the playersmeet some standard set of rules and can work together based on themWith cars, it's state inspection With food preparation, it's healthinspection With any structure, it's building code In every one ofthese, the bare minimum is almost always just that, and the grossmajority strive to be better If your car only barely passesinspection, it's likely not very safe or efficient If your food wascooked in a kitchen that got the lowest allowable score on a healthinspection, there's a good chance that you'll be sick in the nearfuture If your house only meets building code minimums, it likelywon't hold up very well in a wind stormSo, given that compliance is just the bare minimum, and that the bareminimum is not something you should be aiming for, why is it that somuch effort is spent in the financial industry on being compliantAlmost all of the security breaches in recent memory and likely in tothe future have been and will be at organizations compliant withsecurity requirements Compliance is a minimum, and the minimum isnever good enough when you're dealing with other people's moneyStriving for compliance is like trying to come in last placeReal security should be approached just like all other parts of thebusiness You need to have a metric, you need to measure it, and youneed to manage it In security, the metric is risk, and it is measuredagainst cost and the risk mitigated That's the theory anyways Inreality, it's so much more than just cost vs reward Something we tryand make clear to our customers is that there is a balanced securitylevel for every organization, system, and situation It is reachedwhen security reaches a level where it complements all other parts ofthe business and is maintainableIn the end, your goal should be security, not compliance Complianceis a byproduct of good security practices and good corporatestewardshiphttp://www.secuobs.com/revue/news/78795.shtmlhttp://www.secuobs.com/revue/news/78795.shtml Secuobs.com : 2009-04-03 12:30:52 - White Badger Group Blog - This article on physorgcom was posted a little while ago and gives anexcellent example of how important it is to stay paranoid or developa healthy sense of it In short, a photograph of physical keys can beused to duplicate them All that is required is a shot showing all ofthe details, which can be snapped at quite a distance with the rightlens While it definitely is more of a threat to residential-gradestuff than Medeco government/military-grade locks, it's a greatexample that threats are everywhere It's important to always assumeevery part of your organization is vulnerable to some extent, and toplan for it Doing so will ensure that you are considerably moreprepared for the time when not if something failshttp://www.secuobs.com/revue/news/78794.shtmlhttp://www.secuobs.com/revue/news/78794.shtml Secuobs.com : 2009-04-03 12:30:52 - White Badger Group Blog - As with all New Year seasons, everyone chimes in with predictions for theyear to come, along with retrospectives of what the previous yearbrought While not strictly a seasonal occurrence, many suchwritings/articles/declarations/rants/etc contain rather outlandishpredictions and assertions which are meant to be shocking at worst,and visionary at bestRecently, I've seen several pieces which fall into this category, andwould like to toss my own two cents on the pile The one that sort ofkicked off my initiative to write this was a posting by AdrielDesautels which appeared on the Snosoft blog and on the pentestingmailing list The post asserts that vulnerability scanners don't workThe point is made that vulnerability scanning is not an effective toolbecause the core pieces fall on the tail end of vulnerability researchand the scanners themselves aren't accurate On the accuracy part, theclaim is made that his best case experience with scanning tools is 30%accuracy that's obviously a guesstimate, as no hard data isprovided Adriel's conclusion is that the best replacement for avulnerability scanner is a well-trained penetration testing team whichconducts its own researchOf course, as with many outlandish claims, I disagree Going down thelist, I'd have to say first that of course vulnerability scanners havea huge amount of value, and definitely have their place His estimateof 30% accuracy I suspect to be completely made up, and will continueto until I see some sort of data to back it up Also, no referencepoint is given on that number Is it 30% of all vulnerabilities thatever have been or ever will be known about a system What is 100%then Is this counting false positives and negatives or just one ofthem, or neitherMy experience with Nessus, Saint, nCircle, and others has shown thewhole class of tools to be hugely useful, so long as you look at themin the right context What's important to keep in mind is exactly thetitle of this post All tools have their place, and all needs have aset of tools which address them best Vulnerability scanners aregenerally useful in two roles The first is in a one-time look at anetwork I use Nessus whenever I assess a client's network for thefirst time That's because in addition to pointing outvulnerabilities, it gathers tons of data What's best is that it doesthis automatically I could use a collection of 20 or more tools toenumerate hosts and poll their various services for data, but that's awaste of time when a vulnerability scanner will do all of it for meWhile the vulnerability scanner is doing its thing, I'm free to do awalk of the premises, talk to staff, or take a nap All of these aremuch better uses of my time than running individual tools manuallyWhen the initial scan is done, I can then take closer looks atspecific hosts and services with more specific tools if need be Mytime at a client site is usually quite limited, so it's important forme to make the best use of itThe other case where a vulnerability scanner is very useful is where awhole network needs to be monitored for change Because thevulnerability scanner is pretty consistent in what it does and verybroad in what it covers, and because the whole process is automated,scans can be done in intervals very easily Data sets can then becompared over time to show trends in vulnerability and give hard dataabout where the most vulnerability probably is I want to key in onthe fact that I say "probably" in the last sentence for a reasonVulnerability scanners are plenty of useful, but what they aren't isperfect Adriel's article is pretty much centered around the mainweakness of any automated security tool, which is that they can't seeeverything, and a good deal of security is in the soft/squishy partthe people and organization Additionally, he makes the point of thelag time between vulnerability discovery and detection by scanner, butwe'll get back to that Backing up a bit, the reason you can't use avulnerability scanner to identify where vulnerability in your networkdefinitely is, is because of a lack of comprehensiveness of the tool,and the sheer complexity of vulnerabilityVulnerability scanners can't tell you that your policy is terrible orthat the structure of your network is poor They can't tell you thatFrank in accounting took home all of your company's customer data, andthey can't even begin to detect your lack of visibility into thetraffic flowing across your WAN What they can do for you and me,however, is catch low-hanging vulnerabilities and report them in anautomated manner and allow us to use our time handling other tasks Aswith all tools in all industries, you can't expect a tool meant forone task to be the end-all, be-all solution to something asconceptually large and complex as "security"To address the issue of lag time between vulnerability discovery anddetection by a vulnerability scanner, I believe this is a moot pointThis lag exists in all tools and solutions in one form or another, andwhere one tool or solution might have a lower lag than others, itcan't be considered comprehensive Specifically, Adriel suggests thatteams of security professionals replace vulnerability scannersfunctionally in organizations This is just plan silly for a varietyof reasons First is cost an internal team of security professionalsis simply out of the question financially for most organizationsContracting out the service just once is also expensive compared toeven the most expensive vulnerability scanners Nessus goes for$1200/year/scanner, nCircle is upwards of $30k for the initialinstallation Getting a team of specialists to do even the basics ofwhat a vulnerability scanner can do is a wasteHowever, sticking to the title of this article, I believe that alltools and solutions have their place and that there is a properprocess to attack any problem For security, you first need to performgap analysis In the early stages of reaching a secure state, toolslike vulnerability scanners are extremely useful, because they allowyou to efficiently identify and address the most numerous and obviousflaws A security professional's role here shouldn't require muchdirect interaction with the systems at all Automated tools will churnup enough information to get an idea of where things stand, and helpto identify major problems This is your typical VulnerabilityAssessment; a broad process which should take a shallow look at thewhole organization, identify major and core issues, and develop a planfor action This sets the current state and outlines a goal stateThe middle parts of the process require different tools for differentreasons The vulnerability scanner is still very useful here for thetracking of remediation and detection of new minor issues, but givesway to higher-end planning and consulting which aims to set upcontrols which proactively secure the network, and do so inintelligently redundant layers The latter parts of a security ramp-upare where the vulnerability scanner becomes a minor player in that itis used to catch smaller issues which fall through the more proactivesteps put in place to take care of issues before they causevulnerability Also, this phase of the process is where penetrationtesting becomes relevant As is stated in this rather controversialprediction by Brian Chess, penetration testing should be used astesting is in the scientific process That is, penetration testingshould be used to test a theory The theory should be something alongthe lines of: "security control ABC should stand up to XYZ types ofattack, and those attacks should trip some sort of alarm when acertain point is reached" In other words, a security control isdesigned and put in place earlier in the process, then needs to bestress tested to prove that it is working as expected This is exactlyhow we've approached penetration testing especially since we make itvery distinct from our vulnerability assessment service since day onehere at White BadgerSo to sum up, early in the security ramp-up process where mostorganizations haven't even started, automated tools likevulnerability scanners have a huge amount of value because they allowfor a large amount of data to be collected and acted on in a veryefficient manner As the process goes on, the more automated toolsgive way to more specialized tools used to assess certain specifichosts/services/vulnerabilities At the end of the process, penetrationtesting is performed, and that is almost entirely manual The best inmy opinion, the best are the most realistic, regardless of scalepenetration tests will combine attack methods from all differentangles to properly estimate the success rate of exploiting avulnerabilityVulnerability scanners aren't worthless That's like saying that atable saw is worthless because all woodworking can be done with ascrewdriver and a utility knife The worth of a tool is directlyproportional to its cost and benefit Vulnerability scanners generallyhave a low cost relative to their closest alternatives, and a highpayoff so long as the expectation is reasonable They have their placein the security process and won't be replaced functionally by anadjacent tool any time soonhttp://www.secuobs.com/revue/news/78793.shtmlhttp://www.secuobs.com/revue/news/78793.shtml