Security Corner

October 15, 2009  2:42 AM

How to Make a USB Thumb Drive Laptop Theft Alarm

Ken Harthun Ken Harthun Profile: Ken Harthun

Picture this: Someone tries to steal your laptop off your desk and as soon as they pull the plug from the wall, your latpop emits a screaming siren that won’t quit until your password is entered to unlock the laptop and disable the alarm.

There’s another scenario: You take one of your old USB thumb drives (maybe the one you used to make an anti virus bootable scanner) attach a chain to it and secure it to your desk; if someone tries to move your laptop, unplugging the USB thumb drive in the process, the alarm goes off.

This is possible because of an interesting piece of software called “LAlarm.” It’s free for personal use and there’s a nominal fee for commercial use. Download LAlarm from this link:

I tested this software by installing it on my Dell laptop. It works. You simply install the software, configure the options you want and restart your laptop. To set the alarm, you just press Windows key + L to lock the workstation. If anyone pulls the plug or removes the thumb drive, the alarm sounds.

There’s much more to the software than just an alarm. You can set the software to destroy your data in selected folders in the event of a theft. You can also set zones based on IP addresses and cause an alarm to sound if the IP address changes.

The theft alarm is not affected by the system volume control setting–it’s screaming loud no matter how you have your volume set.

It’s a very cool tool.

October 13, 2009  1:20 PM

Protecting Your Business from Online Banking Fraud

Ken Harthun Ken Harthun Profile: Ken Harthun

I’m pleased to see some professionals with clout advocating a security practice I have often recommended to my clients. Brian Krebs of The Washington Post and SANS Institute are both pushing the use of Linux live CDs for online banking. Krebs’ latest article, “Avoid Windows Malware: Bank on a Live CD,” starts off by recommending people NOT use Microsoft Windows for online banking:

An investigative series I’ve been writing about organized cyber crime gangs stealing millions of dollars from small to mid-sized businesses has generated more than a few responses from business owners who were concerned about how best to protect themselves from this type of fraud.

The simplest, most cost-effective answer I know of? Don’t use Microsoft Windows when accessing your bank account online.

Krebs has reported frequently about some of the more prominent online banking fraud incidents, including the hack against Bullitt County, Ky. and two California firms that lost a combined total of more than half a million dollars, both of which were using two-factor authentication requiring the use of a security token.

The credential-stealing Trojans used in these attacks were designed to avoid detection by normal anti-malware software, so the victims had no clues that they had been infected. With the huge amounts of money involved, it’s likely the cybercriminals have evolved their programming skills to the point where it will be difficult for security firms to keep up.

It’s not surprising, then, that SANS, as a direct result of Krebs’ reporting, issued a challenge to its students to create a white paper to determine the most effective methods for small and mid-sized businesses to mitigate the threat from these types of attacks. The report, “Protecting Your Business from Online Banking Fraud,” addresses the issue. Here’s that report’s Abstract:

Recently, small and medium businesses have lost millions of dollars from fraudulent electronic financial transactions.  This paper reviews the threat and provides guidance for mitigating the threat.  These crimes typically begin with a phishing email targeted at the comptroller or other staff in the finance department.  After the comptroller’s computer is compromised, sophisticated malware is used to eavesdrop on the comptroller’s activity and account credentials for financial systems.  Once the attackers have the required information, they begin to steal money with fraudulent transactions in amounts below $10,000.  These smaller amounts fly under the laundering detection mechanisms in the US Bank Secrecy Act.  In many cases, repeated transactions have added up to hundreds of thousands of dollars lost by individual organizations.  The paper provides a number of possible ways to mitigate these types of attacks.  A defense in depth approach is used to provide multiple mitigation recommendations.  The number one recommended mitigation is to use a read-only bootable alternative media (ROBAM) as an isolated environment for financial transactions. [emphasis added] The mitigation steps also include protecting the email address of the comptroller, network protection, endpoint protection, virtual machines, awareness training, policy changes and monitoring financial transactions.

I highly recommend that everyone responsible for security in their organization read this paper.

October 12, 2009  12:32 AM

October 2009 Patch Tuesday Sets New Record

Ken Harthun Ken Harthun Profile: Ken Harthun

Microsoft Security Response Center’s October 2009 Bulletin Release Advance Notification:

For October we are releasing 13 bulletins (eight critical and five important), addressing 34 vulnerabilities, affecting Windows, Internet Explorer, Office, Silverlight, Forefront, Developer Tools, and SQL Server. Most of these updates require a restart so please factor that into your deployment planning.

Ten of the 13 bulletins–which include all eight critical vulnerabilities–involve patches for remote code execution vulnerabilities. All versions of Windows and Windows Server, including Windows 7 (scheduled for release on Oct. 22) are affected.

This sets a new record for Microsoft. The previous record was set in June when the company issued 31 updates. I’m not too sure how to take this. I’m certainly glad that Microsoft is addressing its security problems, but the trend is a bit disturbing: 28 patches in December, 2008; 31 patches in June, 2009; and, 34 patches this month. We still have the better part of 3months left in 2009. Will we see another record set before year end?

What do you think? Does this mean that Microsoft is being more security conscious or are there more bugs than ever?

Hit the comments and weigh in.

October 8, 2009  2:18 AM

Hacking Skills Challenge – Level 6

Ken Harthun Ken Harthun Profile: Ken Harthun

Well, slow security news week, so let’s tackle the next hacking skills challenge level. So far, we’ve explored the first 5 basic missions at At each new level, the difficulty increases. At level 6, we’re dealing with a bit of cryptography. Don’t worry, you don’t have to be a PhD to figure it out; it’s a pretty simple algorithm. The encryption table is publicly available. Here’s the challenge:

An encryption system has been set up, which uses an unknown algorithm to change the text given. Requirements: Persistence, some general cryptography knowledge.

Network Security Sam has encrypted his password. The encryption system is publically available…

You have recovered his encrypted password. It is: bc8g76g<

Your recovered password will be different, but the algorithm to solve it will be the same.

There’s a form where you can enter a text string and have it encrypted by the algorithm used, so that’s a good place to start to solve the cipher. My first attempt was to enter the encrypted password and see what I got back out of the algorithm. The output was bd:j;;mC. Clearly, this is shifting algorithm of some sort, with the first position, position 0, remaining unchanged. I went ahead and tried the ROT(n) algorithms, even though they don’t usually deal with numbers. No joy there. But a good look at the output might indicate a successive addition pattern: the first postion is 0, so the letter remains the same; the second position, 1, increments to the next letter. Reversing the pattern would yield 0, -1, -2, etc.

The presence of symbols suggests the ASCII symbol set and this is what works out to be the solution. Get an ASCII table. For each character position, count backwards from the letter in the password the number of places corresponding to the position number. So, for b, count back 0, for c, count back 1, for 8, count back 2, etc. This will give you bb6d31a5 which is the original password.

Mission accomplished!

October 7, 2009  1:59 AM

Microsoft Security Essentials is a Game Changer

Ken Harthun Ken Harthun Profile: Ken Harthun

Microsoft’s Security Essentials (MSE), released last week amidst criticism from antivirus giant Symantec, is proving to be effective, robust protection against current malware threats. Performance analysis by shows that MSE is on par with many other standalone antivirus products.

Using Windows XP as a testbed, AV-Test pitted MSE against 545,000 current computer worms, viruses, backdoors, bots and Trojan horses; MSE detected more than 98 percent. It detected just over 90 percent of adware and spyware samples and excelled at detecting and removing rootkits.

My experience with MSE so far mirrors the company’s claims that the program “…runs quietly and efficiently in the background so that you are free to use your Windows-based PC the way you want—without interruptions or long computer wait times.”

Any way you look at it, MSE is a game changer. While it’s currently only available as a downloadable add-on to Windows, I doubt it will be long before it comes bundled with the OS on new PCs. When that happens, the AV giants are going to find themselves hard pressed to come up with legitimate reasons for someone to purchase their products.

September 30, 2009  9:43 PM

Security Maxims of a Different Breed

Ken Harthun Ken Harthun Profile: Ken Harthun

Search for “computer security maxims” on any of the top three search engines (Google, Yahoo, Bing) and my articles mostly dominate the results. So I was quite surprised that Security Now Episode #215, entitled “Security Maxims,” gave no mention whatsoever of my contributions to this subject over the past three years. Guess I’ll have to take that up with Steve and Leo. To be fair about it, though, the maxims that Steve talked about in the episode, composed by Roger G. Johnston, Ph.D., CPP of Argonne National Laboratory, Nuclear Engineering Division, are related to “…physical security and nuclear safeguards.” However, according to Johnston, “They probably also have considerable applicability to cyber security.” Many of them are also amusing.

Take this one for instance:

So We’re In Agreement Maxim: If you’re happy with your security, so are the bad guys.

Or this one:

Schneier’s Maxim #1 (Don’t Wet Your Pants Maxim): The more excited people are about a given security technology, the less they understand (1) that technology and (2) their own security problems.
Comment: From security guru Bruce Schneier.

How about this?

Byrne’s Law: In any electrical circuit, appliances and wiring will burn out to protect the fuses.

In all, there are more than 60 maxims listed. You can download a PDF of “Security Maxims” if you want to see more. I highly recommend you read them. You may learn something new. Like I did.

Now, I’m out of here. Have to go fire off an email to Steve and Leo…

Comments? Let me know what you think.

September 30, 2009  8:22 PM

Microsoft Security Essentials Goes Live

Ken Harthun Ken Harthun Profile: Ken Harthun

Microsoft Security Essentials is now out of beta and ready for download.

The Microsoft Security Essentials team has this to say:

Microsoft Security Essentials (formerly codenamed “Morro”) is the newest security product from Microsoft that helps protect consumers against viruses, spyware and other malicious software. The program, using the same technology as the Forefront product family, is designed to protect and take the guess work out of you wondering if you are protected or not.

If you’re green, you’re good.

Red or yellow means there is something that needs to be done to keep your PC secure. A single click and the PC is back to the green protected state.

Microsoft Security Essentials is also designed to address cost and other barriers that have prevented many of our customers from running up-to-date security protection on their PCs. Because there are no subscription fees, there is no registration required to collect billing or other personal information.

It also runs quietly in the background scheduling scans when the PC is most likely idle and interrupting the user only when there is an action required to keep their PC secure. It employs practices like active memory swapping and CPU throttling to limit the impact on your PC performance, even on older or less powerful PCs.

Sounds good to me. I’m going to recommend it to some of my less-than-savvy clients and see how it works for them. I’ll even try it myself, though I’m not a good candidate for such a thing, being the security Geek that I am. Still, it can’t hurt. The one thing that’s unclear: Is this going to come standard with every new PC, or does everyone have to make the effort to download and install it?

Stay tuned.

September 29, 2009  12:58 AM

New IRS Scam and It Could Cost You More Than Taxes!

Ken Harthun Ken Harthun Profile: Ken Harthun

You usually see this around tax season, but it seems the cyber-crooks have figured out that fear of the IRS is an evergreen topic.

US-CERT is aware of public reports of malicious code circulating via spam email messages related to the IRS. The attacks arrive via an unsolicited email message and may contain a subject line of “Notice of Underreported  Income.” These messages may contain a link or attachment. If users click on this link or open the attachment, they may be infected with malicious code, including the Zeus Trojan.

The Zeus Trojan is a keylogger that steals sensitive data, especially targeting online banking credentials. According to “New IRS Scam E-mail Could Be Costly”, in Brian Krebs’ Security Fix column, Landfill Service Corp. (LSC), a solid waste company based in Apalachin, NY is a recent victim of the Trojan. The firm may end up losing at least $92,000 from the incident. Not good.

The Zeus keystroke logging Trojan’s engine is a file called “sdra64.exe.” At least that’s what LSC’s tech guy found (Variations are sure to surface).

Rather than repeat it in my own words, here’s the US-CERT list of recommendations:

September 26, 2009  2:46 AM

Protect HTML Code for Increased Security

Ken Harthun Ken Harthun Profile: Ken Harthun

If the challenges at illustrate one thing, it’s that viewing the source code of web pages can often reveal exploitable vulnerabilities. Beyond that, eCommerce sites often have payment buttons, shopping carts and other means to facilitate transactions. If the code for these things is openly visible when viewing the page’s source, a hacker may be able to inject his own code to divert payments away from the rightful vendor and into the hacker’s account. This is particularly true if the code is straight HTML or raw Javascript rather than scripts hosted on a secure server.

One solution is to encrypt the web page code. A web search will reveal plenty of tools to accomplish this; one that I’ve tried is HTML Encrypt. It’s easy to use, just paste your raw code into the text entry box, click the “Encrypt” button and see your encrypted code in the lower panel.

It’s not a substitute for secure coding, but it can serve as an effective deterrent.

Comments? Go ahead and hit the button.

September 23, 2009  8:15 PM

Hacking Skills Challenge – Level 5

Ken Harthun Ken Harthun Profile: Ken Harthun

So far, we’ve explored the first 4 basic missions at As we get to each new level, the difficulty increases, but they’re still pretty easy.

Today, we solve level 5:

Sam has gotten wise to all the people who wrote their own forms to get the password. Rather than actually learn the password, he decided to make his email program a little more secure.

If you try the same tactic we used to solve level 4, you’ll get the error message, “Invalid referrer. The requested URL /missions/basic/5/level5.php will not be loaded.” You get this because the script checks the HTTP headers to see where you are viewing the page from. If the url is not /missions/basic/5/ or /missions/basic/5/index.php then it will give an error. Since you’re viewing it from a local file, the script fails.

There are two approaches we can take here: 1. Change the email address in the script using some form of code injection; 2. Use an online monitor/debugger that allows us to edit a page on the fly.

For the first approach, Javascript injection allows us to change the email address using the following code: javascript:alert(document.forms[0].to.value=”put_your@email. here”); Enter that in the address bar, hit Enter, and you’ll be greeted with an alert box show the email address you entered. If you then click the “Send Password to Sam” button, the password will be revealed. Copy the password, paste it into the password field, click Submit and you’re in. Like the last exploit, the page won’t actually send the password to the email address. In fact, you don’t even have to change the email address in the code; it will work as shown.

For the second approach, if you use Firefox, you can install a cool add-on called Firebug. This powerful tool allows you edit, debug, and monitor CSS, HTML, and JavaScript live in any web page. I installed it, went to the challenge page and used the “Inspect Element” feature to see what was behind the “Send Password to Sam” button. Then, within Firebug, I changed the email address. When I clicked the “Send Password to Sam” button, the password was revealed.

Either way, mission accomplished!

(In a future post, I’ll show you how to hack any stored password using a similar javascript approach. And I’ll make sure you adopt a policy to never used a “remember me on this computer” check box on a publicly accessible PC ever again!)

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: