Navigation

You are here: Home › Security

Archive | Security

Security is not a feature; it’s a process. Notes on issues, patches and essays on security.

Browser vulnerabilities get stealthy

By on November 2, 2006 in Security

Over at DDJ.com, they're reporting that “New Hacker Toolkit Cloaks Browser Exploits” No real surprise there – polymorphic browser exploits can avoid primitive signature detection techniques that just look for “DO BadCode()” in the payload. Code that runs in a browser has to run in a safer environment, like the “security sandbox” design of Java. ActiveX controls are just Windows executables that run with the permissions of the user. That won't work, no matter how many “digital signatures” or “Are you sure” dialogs MS layers on top of their insecure design. JavaScript isn't much better with the potential for downloadable JavaScript network scanners implying that every device on the network must be firewalled from every other.

There are no easy solutions in sight. Run with the least privileges practical. Firewall off unneeded services. Scan for unacceptable activity in memory and on disk. Turn off runtime capability in the browser except when needed – Flash, ActiveX, JavaScript and Java should only run with permission of the user.

The Ten Most Dangerous Things Users Do Online

By on October 24, 2006 in Security

Byte.com features “The Ten Most Dangerous Things Users Do Online” from the folks at http://www.darkreading.com/. “Online” is kind of a funny thing to tack on the end of this article title. Reading email might occur on- or off-line, but for most of us, does it really apply any more?

CentraLUG, November 6: Digital Forensic File Carving Techniques

By on October 23, 2006 in Linux, OpenSource, Security, Technology

The monthly meeting of CentraLUG, the Concord/Central NH GNHLUG chapter, happens the first Monday of (most) months on the New Hampshire Institute Campus starting at 7 PM.

Directions and maps are available on the NHTI site. This month, we’ll be meeting in the Library/Learning Center/Bookstore, room 146, marked as “I” on that map. The main meeting starts at 7 PM, and we finish by 9 PM. Open to the public. Tell your friends.

For November’s meeting, Andy Bair will present “Digital Forensic File Carving Techniques.” Data carving techniques are used during digital forensic investigations and existing file carving tools typically produce many false positives. This briefing describes new tools and techniques used by the winning team of the the 2006 File Carving Challenge held at the 6th Annual Digital Forensic Research Workshop (DFRWS). The current briefing is also located here.

In December, Tim Lind of Computerborough will present TrixBox, the Linux distro for running the Asterisk PBX software, formerly known as “Asterisk @ Home.”

January’s meeting falls on the first, so we’ll likely skip the month’s meeting. However, stay tuned for some exciting meetings coming up in 2007! More details on the group and directions to the meeting at http://www.gnhlug.org.

OOBE as it was meant to be…

By on October 20, 2006 in Apple Macintosh OS X, Linux, Microsoft, OpenSource, Security, Technology

I've been holding off on purchasing a new laptop until IBM/Lenovo had a Linux-compatible ThinkPad T61p with the Merom (“Core 2 Duo”) CPU installed. “End of October” is the latest estimate, but knowing how long Real Soon Now can get to be, I elected to pick up a bench spare laptop Just In Case. My primary machine (“Lucky”) had a dead LCD, fried USB ports and a flaky wireless card. My older beater laptops have about bit the dust. I shopped around the BigBox stores and they were selling consumer junk. I looked at the Apples; they're sweet machines, but the software's still proprietary. If I was going to go for an Apple, I'd want to pick up a monster machine, and the budget doesn't allow that. So, for a while I was stumped. Finally, Laura suggested I look at a lower-model ThinkPad to tide me over.

IBM/Lenovo has a site for refurbished machines. I shopped over a couple of days. Keep an eye on the site, as inventory is changing often. I finally selected a T40, Pentium-M 1.5GHz, 256 Mb RAM (with a free upgrade to 512), 40 Gb HDD, WinXPPro, 1024×768 and CD-RW/DVD for just under USD $700.

With UPS ground shipping, it took less than a week to get here. The Out of Box Experience was perfect. Clean and well-packaged, the machine looked new. Other than a couple scratches on the serial number label, you'd think this thing had been vacuum-packed since it was manufactured in June of 2003. The HDD was a clean install of WinXP, and the “preinstallation” process took about an hour to install XP, forty million patches, IBM custom tools and drivers. A couple onerous registration forms (Yes, I want to register, no, I don't want you to have your “partners” send me mail) and I was up and running. First, a trip to Windows Update. A “new version” of Windows Update (the dreaded Windows Genuine Advantage check — I passed! Whew!) and I was up to date. I was surprised to find that Windows Firewall was not running — I had forgotten is was off by default, and was glad I was within a reasonable safe network as I raised the shields.

Next, a backup before I broke things. Booting onto a Knoppix CD, I followed the same process I used in July to upgrade Laura's hard drive: with the machine off, plug in an external drive and Knoppix, boot, Ctrl-F2 to a root console,

mkdir /media/target
mount /dev/sda1 /media/target
partimage


and in eleven and a half minutes, the 4.5 Gb is backed up. Magick!

I was suprised to see that the recovery partition isn't a partion at all, according to the machine, but unpartitioned space at the end of the drive. That makes it a bit more difficult to make a backup copy for the inevitable hard disk drive failure. IBM's help file tries to explain how this is a feature to keep you from mis-laying a Recovery CD (You'll have to order one from IBM when the hdd fails, it explains. Of course, it will be a little difficult to read the help file on the hdd to discover this once it's failed.) Google, of course, will point you to solutions that can work around pretty much any “feature” the vendor throws in there.

Overall, I'm pretty pleased with the machine, and it will work great as a stopgap between Lucky and the next machine, and at a good price. Now, off to tinker some more…

The good news: it's not an IE7 vulnerability. The bad news?

By on October 20, 2006 in Microsoft, Security

SANS Internet Storm Center, InfoCON: green is reporting New Internet Explorer and an old vulnerability, (Fri, Oct 20th). “As you probably know by now, Microsoft yesterday released the final version of Internet Explorer 7 …”

There was a great flap as Secunia grabbed the headlines by claiming that they had found a vulnerability in IE7. Not so, claims Microsoft! The vulnerability is in Outlook Express, installed by default on all Windows installations. And the flaw is a known one, seven months old. And it's unpatched.

So, how does a newer “secure” browser supporting an older, unpatched vulnerability, unfixed for over 200 days, mean we're more secure now?

InfoWorld: Microsoft re-releases a security patch

By on October 20, 2006 in Microsoft, Security

Microsoft reissues buggy patch for Windows 2000 users.

(InfoWorld) – Microsoft has reissued a Windows security patch that it published last week because the software did not work properly on Windows 2000 systems.

Folks running Windows 2000 servers, take note! Your machines are still vulnerable until you install this patch.

Yet another PowerPoint security exploit

By on October 14, 2006 in Microsoft, Security

InfoWorld: Application development reports: “Microsoft warns of new PowerPoint attack. Just days after patching four bugs in PowerPoint, Microsoft is warning of a new attack targeting its presentation software.”

Boy, Microsoft is just not catching a break this month! Don't open untrusted PowerPoints. Don't run as an admin – configure your day-to-day user account as a Least-Priviledged-User.

MS Patch Tuesday: 10 patches, 3 critical, all important

By on October 10, 2006 in Microsoft, Security

SANS Internet Storm Center, InfoCON: green does a far more thorough job than I can of summarizing Microsoft patch tuesday – October 2006 STATUS, (Tue, Oct 10th). “Overview of the October 2006 Microsoft patches and their status.”

A really quick summary: exploits in asp.net, in an IE “safe” ActiveX control, PowerPoint, Excel, Word, MSXML, Office, Publisher, the Server service, IPv6 and the Object Packager (wow! Haven't used that since OLE 1.0!). MS06-056-065. Get Patching! Try OpenOffice.org. Try FireFox. Think Differently. Good luck.

Is your mail server part of the problem?

By on October 9, 2006 in Security, Technology

SANS Internet Storm Center, InfoCON: green is discussing Spam Backscatter, (Mon, Oct 9th). “Over the weekend I dealt with the rather massive after effects of a spam campaign spoofing a domain” …(more)

I'll second that! As the article goes on to indicate, many innocent mail administrators are a part of the problem by not changing naive settings of their servers. We need to encourage all the mail server software authors to change their default behaviors to fail to deliver mail silently: bounces from non-existant mail addresses are clogging the internet's pipes with replies to spoofed senders. “No such postbox” and “mailbox filled” are courteous, but since your server likely doesn't really know the sender, it's not just a waste of effort, but a an imposition on others to read your counter-spam. Let's all be a little quieter and learn more from listening than responding.

MS6-053 an Internet Explorer Cross-Site Scripting exploit?

By on October 5, 2006 in Microsoft, Security

Swa Frantzen is manning the SANS Internet Storm Center, InfoCON: green desk today, and struggles to work out the exploit Microsoft documents without admitting in MS06-053 revisited ?, (Thu, Oct 5th). “When we first read MS06-053 we ended up discussing and not fully understanding what Microsoft was…” (more)… The article explores what appears to be an IE cross-site scripting exploit but with the character set UTF-7 (yes, seven! – who knew!) and some advice to webmasters to help avoid spreading the problem by echoing a bad URL back to the user.

Older posts Newer posts

Powered by WordPress. Designed by Woo Themes

This work by Ted Roche is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 3.0 United States.