Encryption

Trust Only https:// on Form Pages

How often, when you log into a site that requires a username and password, to you check to see if the connection is secure? You probably don’t give it a second thought. Most people don’t. For many sites, like newspapers, online magazines, etc., it probably doesn’t matter much. Who cares if someone logs into a news site with your credentials? They’re not going to gain anything by doing so and there’s no identity or personal financial information at stake.

For any sites where you are accessing or entering sensitive identity or financial information such as bank account or credit card numbers or government program IDs such as Social Security numbers, State identification numbers or the like, you are seriously at risk of identity theft if you trust this information to a form that is served as “http://[URL].” It’s true that the Submit button may invoke transmission of the information using https:// (SSL), but there is no guarantee that this will happen, so you risk sending your information “in the clear.”

Best practice: change all of your bookmarks pointing to financial and other sensitive site login pages to read “https:// [URL of site].”

Free Encryption Tool for the Absentminded

Security software firm SOPHOS (I’ve tested their products in the past) sent me an email yesterday offering a free encryption tool. I tested it this evening and I’m impressed. It’s very simple to use and is definitely a cure for the absentminded:

Whether you lose your laptop, misplace a CD
or leave your USB drive in the coffee shop,
if it’s encrypted you don’t have to worry about
becoming tomorrow’s headline!

Get the FREE Sophos encryption tool now
and you can lose your data without
losing your mind.

Sophos FREE Encryption:
an easy to use tool that encrypts your files, folders and emails.

I suggest you download this immediately and pass it on to everyone you know. Combine this with the LAlarm software and you have an unbeatable combination.

Here’s the download link: http://www.sophos.com/mk/get?_EC=2LMC0U-…

Let me know what you think.

Protect HTML Code for Increased Security

If the challenges at Hackthissite.org illustrate one thing, it’s that viewing the source code of web pages can often reveal exploitable vulnerabilities. Beyond that, eCommerce sites often have payment buttons, shopping carts and other means to facilitate transactions. If the code for these things is openly visible when viewing the page’s source, a hacker may be able to inject his own code to divert payments away from the rightful vendor and into the hacker’s account. This is particularly true if the code is straight HTML or raw Javascript rather than scripts hosted on a secure server.

One solution is to encrypt the web page code. A web search will reveal plenty of tools to accomplish this; one that I’ve tried is iWebTool.com HTML Encrypt. It’s easy to use, just paste your raw code into the text entry box, click the “Encrypt” button and see your encrypted code in the lower panel.

It’s not a substitute for secure coding, but it can serve as an effective deterrent.

Comments? Go ahead and hit the button.

FAA Gives PKWare’s SecureZip Stamp of Approval

It doesn’t surprise me that the inventor of the ZIP file format was recently awarded a large enterprise
software license and maintenance agreement from the Federal Aviation Administration (FAA). What does surprise me is that with my network of security news sources, I hadn’t heard about this product before now.  Granted, I’m mostly an Open Source guy and SecureZIP is commercial software ($39.95 for a single-user license), but I was asleep on this one.

PKWARE’s SecureZIP software will initially be deployed across 50,000 Microsoft Windows® desktops
at the FAA and Department of Transportation (DOT).

I like the way SecureZIP leverages PKI. It enables users to secure files and folders with strong passphrase or digital certificate-based encryption. It also supports digital signatures to ensure data integrity. SecureZIP makes acquiring and using a digital certifcate simple: Upon installation, SecureZIP will automatically request and install (if desired) a digital certifcate from Comodo.

I like AxCrypt and have been using it for quite some time for simple security. AxCrypt doesn’t offer compression, however, so you have to create an archive first, then encrypt it. Moreover, you can’t use certificates or employ digital signatures. SecureZIP is a clear winner for robust security with compression.

I’m headed over there right now to get an evaluation version.

How to Use the Windows Registry for Cyber Forensics: Part 2

In Part 1 of this series, I introduced you to the concept of date/time coincidence and we explored five registry keys that are useful to the forensic examiner. This time, I’ll show you how data can be encrypted and hidden in the registry.

If you’re involved in data security, you’re familiar with cryptography in some fashion and you know that ciphers - algorithms for performing encryption and decryption - are what do the work. You probably also know that there are a few quick-and-dirty algorithms for encrypting data. One such algorithm is known as the Caesar Cipher, or ROT-13, a simple algorithm that encrypts data by shifting each character 13 places in the alphabet while leaving non-alpha characters untouched. It’s so simple that you can decrypt it manually, but it’s enough to fool the casual observer. Anyone coming across something like cnffj beqsb egurf rperg svyrf vfcnf fjbeq, is naturally going to assume it’s encrypted; in fact, it’s ROT-13 for password for the secret files is password. I broke it up into five-character groups to make it more convincing.

For whatever reason, Microsoft uses ROT-13 to encrypt data in some registry keys. One such key is: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist. Here’s an example: “HRZR_EHACNGU:P:\AFYBBXHC.RKR.” Decrypted, that’s “UEME_RUNPATH:C:\NSLOOKUP.EXE.” (We’ll look at the UserAssist key in Part 3.) A better way to hide data is to encode text-based information in binary format and store it in binary form as a string in registry values of type REG_SZ. Given that binary data is common in the registry, the technique would make it extremely difficult to retrieve the hidden information.

In addition to using ROT-13 and binary encoding to obfuscate data, a suspect could take advantage of a flaw in the registry editor to also make the data invisible to anyone but a forensics examiner who knows about the flaw. From “Forensic Analysis of the Windows Registry:”

The Windows 2000 and XP Registry Editor (regedit.exe or regedt32.exe) have an implementation flaw that allows hiding of registry information from viewing and editing, regardless of users access privilege (Secunia, 2005). The flaw involves any registry values with name from 256 to 259 (maximum value name) characters long. The overly long registry value (regardless of type) not only hides its own presence, but also subsequently created values (regardless of type) in the same key (Franchuk, 2005). The editor stops displaying the remaining of the values thinking the overly long value as the last value in that key. Suspect could exploit such Registry Editor flaw to hide information.

The Windows console registry tool (reg.exe) can display these overly long registry values so the hidden data can be recovered as evidence; however, given the sheer number of entries in the registry, this process is not trivial.

I hope this series is giving you some insight, perhaps even piqueing your interest, in cyber forensics. Hit the comment button and tell me what you think.

In Part 3, we’ll explore some keys that can tell us where a suspect has been storing files.

Pagefile.sys is a Security Risk

Since the early days of Windows (3.x and forward), the operating system has relied upon vritual memory in the form of files stored on the hard drive to compensate for the lack of a machine’s physical memory. When the machine’s physical memory begins filling up, pages of data are moved from physical memory to the virtual memory file. Until Windows NT, this file was called win386.swp; when NT came along, it was renamed to pagefile.sys. While the pagefile generally enhances performance, it’s a security risk.

For one thing, Windows’ default behavior leaves the pagefile intact when a user logs out, so there’s a good chance of viewing information in any files the user opened while logged in.

Encryption doesn’t necessarily mean the data is safe, either. Sure, the file itself is encrypted, but in order to work with encrypted files, the system must first decrypt them and this unencrypted copy may be stored in the pagefile.

There’s a simple registry setting that will clear your pagefile when you shutdown your computer. Why this setting isn’t enabled by default only makes sense from a performance standpoint. It may take Windows slightly longer to shut down, but you’ll rest easier knowing your confidential data isn’t at risk.

Start regedit and navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSIONMANAGER\MEMORYMANAGEMENT

Set the key ClearPageFileAtShutdown to 1

Close regedit and reboot your computer to apply the change.

Another Little Known Tool to Securely Delete Files, Folders, and Volumes

Why, all of a sudden, is everyone concerned about secure file deletion? I hesitate to say it’s a sign of the poor economy, but perhaps people consider it even more important to protect their personal information when the idea of losing control of their assets—and their lives–through the incompetence of corporate “managers” and well-intentioned but clueless politicians is more abhorrent than losing control through the outright thievery of Internet gangs. It’s weird. I harped on people about securing their data all along and mostly, my advice fell on deaf ears. Now people are worried. And it’s not because they see more spam email phishing attempts, it’s because they feel they can’t trust anyone anymore, not their formerly respected captains of industry, and certainly not their elected officials.

But, I digress. This post is about security tools, not politics, so I’m now officially off of my soapbox.

I recently posted an article about SDelete, a tool that can be used to securely delete files and folders on a hard drive. There’s another little known, useful tool that has been built into the OS since Windows 2000: cipher.exe. Microsoft provides the following in Knowledge Base article 315672:

How to Use the Cipher Security Tool to Overwrite Deleted Data

To overwrite deleted data on a volume by using Cipher.exe, use the /w switch with the cipher command. Use the following steps:

1. Quit all programs.
2. Click Start, click Run, type cmd, and then press ENTER.
3. Type cipher /w:driveletter:\foldername, and then press ENTER. Specify the drive and the folder that identifies the volume that contains the deleted data that you want to overwrite. Data that is not allocated to files or folders will be overwritten. This permanently removes the data. This can take a long time if you are overwriting a large space.

One more tool you can use to mollify your paranoid clients.

Software for Secure Computing: Easy Email & File Security with AxCrypt

Most of the email we send and receive from our co-workers, family, and businesses contains little that requires any degree of confidentiality. The same goes for most of the files we have stored on our hard drives and thumb drives. Occasionally, however, we need to pass on or store some information that wouldn’t be prudent for us to send or store in clear text, i.e., unencrypted. To go through all of the effort (and it’s a bit of effort, believe me) to set up secure email or create encrypted partitions or directories on the hard drive is a waste of time for most people. Fortunately, there’s a simple, free solution: AxCrypt.

AxCrypt is open source file encryption software for Windows. It integrates seamlessly with Windows to encrypt, decrypt, store, send and work with individual files. It runs on Windows 2000/2003/XP/Vista and uses AES-128 encryption.

Once installed, AxCrypt is integrated into Windows Explorer’s context menu. You simply right-click files and folders in Windows Explorer, select AxCrypt and then select the action you want from the sub-menu (see screen shot). If you choose Encrypt Copy to .EXE, AxCrypt makes a copy of the document, asks you for a passphrase, and creates a standalone, self-decrypting file that you can safely send across the network or store anywhere you choose.

To use AxCrypt for secure email, simply create a text file that contains all of the sensitive information you want to send, make a self-decrypting EXE file, and send it as an attachment. You’ll have to make contact with the recipient off-line to give them the passphrase, but your information will be secure in transit.

The AxCrypt site has plenty of information on how to use the program, as well as an excellent FAQ and command line reference.

Check it out. It’s a great addition to your secure computing software collection.

Software for Secure Computing: Ironkey

There’s an old saw in security circles: “complexity is the enemy of security.” The more complex something is, the more likely there will be flaws to exploit. Too, there are times when you just don’t need the strength of AES encryption. Case in point: the company I work for utilizes a practice management and documentation system to keep track of service tickets, inventory, server & network configurations, and other customer information. Since the software is web-based (which makes it a potential attack target),  we needed a simple method to securely store client passwords and remote access configurations. The solution was Iron Key (not to be confused with the secure flash drive of the same name), a free version of Silver Key–a program for creating self-extracting encrypted files.

The program is perfect for safely sending files over the Internet, even those that contain sensitive personal and financial information. For example, say you have an electronic copy of your tax return that you need to email to your accountant; easy, just drag and drop it onto Iron Key, set a good passphrase and send it along. Your accountant does not need any cryptographic software in order to decrypt the file; all he needs is to run the file and enter the right password, which you can tell him over the phone.

It doesn’t get much simpler than this.

The #1 Security Priority: Protect The Information

SANS recently reported that a Ponemon Institute survey, commissioned by Dell, found that more than 630,000 laptops are lost at airports each year, usually at security checkpoints and departure gates. A staggering 67% of them are never recovered. From SANS NewsBites Vol. 10, Num. 52:

The survey…included feedback from 864 business travelers: 53% said their laptops held confidential data; 42% said their data was not backed up; 16% said they would do nothing if they lost a laptop while traveling on business; 77% said the chance of recovering a lost laptop was less than ten percent.

Surprisingly, the SANS article made no mention that the Ponemon survey found that 65% of the travelers who have confidential or sensitive information on their laptops do nothing to attempt to protect it. The article seems to be more focused on physical security and this is indicative of a paradigm that is too heavily weighted in favor of protecting the network rather than the information traveling across it. The paradigm is shifting, but not nearly fast enough, as the survey shows.

Given the nature of operating systems and software, embedded or otherwise, there will never be a completely secure network; there will always be vulnerabilities to deal with and deal with them we must. However, the Internet is designed for sharing, not securing, a fact that’s never been more true than it is today;  with Web 2.0’s emphasis on community and collaboration, the need to protect the information is even more critical.

We can’t predict security vulnerabilities in third party software and systems, so all we can do is patch after the fact. If we make data protection the first priority and never allow a scrap of sensitive information to reside anywhere on any storage medium without it first having been encrypted or physically isolated, the severity of any newly-discovered vulnerability is greatly lessened.

What do you think?