June, 2009

What is a browser? Video may change your security training strategy

If a major piece of your security strategy revolves around employee training, the following video might be a major setback. Many security pros pride themselves on the amount of training they give their employees. But I wonder, is it all for naught?

A Google employee took a camera and microphone onto the streets of New York City to find out if non-techies knew what a browser is and the results were astounding. Less than 8% of those interviewed knew. And these guys don’t reside in an assisted living facility or a 55 and over community. Many of them could have Facebook accounts and even Twitter handles.

After watching the following video, I wonder, how would I begin a security training program if many of my employees don’t know what a browser is? Phishing sounds like a foreign language and malware sounds like a bad word. Maybe the next generation will have a better understanding. But how long can we wait?

 http://www.youtube.com/watch?v=o4MwTvtyr…

Cligs URL shortening flaw highlights social networking ills

Could flaws in social networks send the Internet spiraling out of control?

A flaw discovered in URL shortener Cligs (Cli.gs) last weekend demonstrates the fragility of the social networking ecosystem and how potentially dangerous it could be.

Cligs competes against TinyURL and Bit.ly, which dominate link shortening on Twitter. It is recognized as the 4th most used link shortener on Twitter. On Monday, Cligs acknowledged the flaw, calling it a security hole in Cligs’ editing functionality.

The attack edited most URLs on Cligs to point to a single URL hosted on freedomblogging.com. I’ve identified the hole and disabled all cligs editing for now and I’m restoring the URLs back to their original destination states.

Lucky for Cligs that whoever discovered the gaping hole only forwarded to a story on freedomblogging.com and not a porn website or attack webpage. According to the blog post 2.2 million URLs were affected.

Phishing attempts (Twishing), Tweetspam and even Twitter worms are being tracked by the major security vendors. Sammy Chu of Symantec Security Response today said the vendor has detected fake Twitter invitations that carry a mass-mailing and malicious worm. The messages appear as if they have been sent from a Twitter account.

This is all very close to spiraling out of control. Attackers are latching on to Twitter, MySpace, Facebook and others and using them to spread malware and harvest data. In a recent interview I had with security expert Lenny Zeltser, he said these short bursts of information – 180 characters on Twitter – alone doesn’t raise any eyebrows. But together with hundreds and in some cases thousands of other posts, the data could be used in a social engineering attack and could in fact harm businesses.

What can be done? To avoid being duped by malicious URL shortening links, Graham Cluley a security consultant with UK-based security vendor Sophos, who was the first to blog about the Clig hack, urges people to run a plug-in that will expand shortened URLs before they are clicked.

But we can’t rely on the public to take action. And they shouldn’t have to. It probably would be difficult for any group or association to take the lead on ensuring the security of social networks, but these organizations may benefit by joining forces in some sort of social network cabal to hash out standards around security and privacy issues.

The good news is that security researchers seem to be on top of the threats and the alarm is being sounded. But why is it taking a group of concerned security researchers and experts to get Google to better secure its Web applications? Who inside the search engine giant or any of these websites are weighing the risks and deciding to let the dice roll on security?

Unfortunately it may take catastrophic event to get any of the social media giants to take action. They owe it to their millions of users to take action and it may be the most prudent approach to ensuring their longevity on the Web.

Now go and listen to this interview with Lenny Zeltser on social networking woes:
http://cli.gs/bnLvDD

New media failed T-Mobile on data security breach claims

In the race to be first, some information sources reprinted a forum post boasting of hacking into T-Mobile servers. In this case it appears to be the media that got pwned.

T-Mobile was put on the hot seat this week after an anonymous person posted a message on a hacker forum boasting of hacking into T-Mobile’s servers, stealing mountains of data, including customer records, account information and T-Mobile proprietary data.

The frivolous poster was seeking money and sought only serious inquiries to those willing to shell out cash for the supposedly stolen information. Several bloggers immediately jumped on the post followed by several publications. With little information, the brief linked to the anonymous post with headlines immediately warning of the next big breach.

The message was posted on Full Disclosure, a forum that has had questionable postings in the past. It showed information on T-Mobile’s various systems, including IP addresses of various servers and enterprise systems. T-Mobile quickly responded to the reports, conducted its own investigation and within a few days, issued several statements with the final one calling the original post unfounded.

“Following a recent online posting that someone allegedly accessed T-Mobile servers, the company is conducting a thorough investigation and at this time has found no evidence that customer information, or other company information, has been compromised,” according to a revised T-Mobile statement.

In case the statement wasn’t clear enough, T-Mobile broke it down into bullet points. There was “no hack or breach of security.” Meanwhile an investigation continues into how the document of T-Mobile server information was obtained.

While the post must have given T-Mobile officials a scare, it is unlikely that a hacker broke in and stole sensitive data, said Alex Rothaker, research and development manager at Application Security Inc. who leads that firm’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) organization. Rothaker said the data on the company’s servers may have come from an insider or someone who worked on T-Mobile’s systems.

“Something as simple as Nmap can give you a lot of that information,” Rothaker said, referring to the free vulnerability scanning tool. “By itself [the information] is not a total breach … This could truly just be somebody playing a prank or tying to make a name for themselves.”

Rothaker said T-Mobile is likely doing a deep analysis of its server logs to try and find any anomalies. The lesson for other companies is to ensure that activity monitoring tools are in place. Access controls should be limited on databases and servers to limit the access to confidential data.

Don’t get me wrong. This wasn’t a failure on a grand scale. Some organizations got the story right, explaining that the post could be frivolous and focusing more on the fact that T-Mobile has initiated an investigation. In any case, T-Mobile officials need to take every case like this seriously. But I hope this issue serves as a reminder for reporters to take a deep breath, confirm information and not rush to post a story for the almighty page view monster without doing a little follow-up work. We’re forgetting some traditional journalistic principles. We need to take a heavy dose of skepticism, especially in the cybersecurity industry where much of the information could be potentially damaging to individuals and companies.

In the race to be first online, I often wonder if we’re driving our journalistic principles into the ground, shredding them to serve up a piece of content that ultimately serves no purpose except to gain as many views as possible. Reporters are pitted against bloggers, many of whom have no formal background or knowledge of journalistic ethics. Ultimately speed does a disservice to the public.

V.i Labs integrates Google maps to track software piracy

Google maps integration looks cool, but in this tough global economy are software vendors going to spend the money needed to pursue offenders?

V.i. Laboratories, Inc., is adding Google maps to its CodeArmor Intelligence piracy threat software. Independent software vendors can use the company’s software by integrating it into the software release process. If the software is used without a license, a hidden software algorithm silently phones home, telling an ISV the location and possible business profile of the offender. It is a cloud-based service and uses Salesforce.com platform to provide a dashboard of reporting data, legal information and product management tools.

In May, a report from the Business Software Alliance (BSA) and research firm IDC found losses to piracy grew by 11% to $53 billion. Dollar losses from piracy in the United States total $9.1 billion, according to the report. Companies that pirate software deserve to be detected and held accountable, but this software appears to go one step further. Instead of treating offenders as criminals, it turns a piracy detection as a lead giving independent software vendors the ability to recover revenue on their own, through channel partners or seek legal action.

The software was first released in August 2008. While most software vendors incorporate a license activation key or some other form of registration to turn on all the features of the software, Vi Labs says it’s just not enough to keep people from using unlicensed versions.

“Currently, ISVs rely on licensing, activation or home-grown approaches to gather data, which are easily detected, bypassed or disabled by piracy groups. These home grown systems also lack filters, advance reporting processes, platform support, and are unable to organize and report the information in a way that can be used to develop a piracy lead.”

The Google maps integration is added through a reporting plug-in for the Salesforce.com platform. Users of the reporting application can look at the Google map (see below) and at a glance get a relative location of suspected software pirates.

It is unclear how many small independent software vendors want to really march down this road. The software is not inexpensive at a minimum price of about $50,000, but if companies can detect pirates and reap lost revenue the investment should be made up. Of course, legal action itself is a cost factor, so the costs of going after software pirates could increase significantly if the offending company doesn’t cooperate. I suspect most firms treat software piracy as a write-off at the end of the day, to avoid legal costs.

In these tough economic times, struggling companies may be more inclined to use software without a license. But at the same time, how do you recoup lost license revenue from a struggling offender with no money?