Research

It’s almost RSA time again. Which means one very important thing: I need to finally post the review of the very slick TPM-based Windows bootable thumb drive Jeff Jones (@securityjones) gave me at RSA 2011. I have been promising him this review since last March, and it would be just too embarrassing to not get it done before RSA 2012. So here we go. As I said above, this slick little device provides a full self-contained Windows install protected by TPM. The entire thing is encrypted. When I was still doing ops, I kept it in my car for when I was out and about without my laptop. It was great for doing quick and dirty troubleshooting using a friend’s computer or library machine without having to worry about what might be on the machine I was using. You know, those public machines can be cesspools of all sorts of badness. Unfortunately it gets less use now that I’m during pure security, but I still pull it out now and again. Pluses Completely encrypted Uses its own memory and disk instead of the host’s Great form factor Ridiculously easy to use Minuses Doesn’t play nice with some laptop video cards Not as fast as using the native hardware by a long shot Can’t boot off a Mac or via a virtual machine What would have made this better? If it completely blocked access to the underlying drives and memory of the host box. Then I would have also used it as a safe browsing environment for conferences and airports and the like. That kind of capability would also be useful for those of you who need research NSFW sites using corporate machines. Admittedly, this would be a substantial feat, especially considering the need to access USB drivers for access to the host. When I used it regularly it was great for confirming that production services were live at my company, and it also allowed me to respond to email using the web gateway. For long emails this was far more efficient then trying to use my phone. If I were buying one, I’d have them preinstall essential security tools such as gpg, 1Password or another password manager, and the appropriate strong authentication software (such as a soft token). You’d also need ssh and VPN clients to make it even more useful. And while I’m putting together a shopping list, how about Skype? That would be really nice to communicate in a pinch. Though I’m not sure if it supports audio devices. Jeff? There are a couple other good use cases. For onsite incident response I would want forensics tools. If I were doing more technical consulting/pen testing I’d want one that booted Linux so I could have tools like BackTrack at my disposal. All in all, even without those tools, it’s a nice form factor for carrying around an emergency OS. I wonder if it’d be possible to get one that dual-booted – that would be even cooler then carrying a couple. You know you have to cut ounces of extra weight when you can. And I know I can get a lot of this functionality from a regular USB thumb drive, which would greatly expand the available options and undoubtedly lower the cost. But for specialized use cases, including toting around ssh and X.509 keys, having a TPM chip and an encrypted drive is very attractive – not to mention the dedicated memory & disk. There are a couple of this type of device out there, and adhering to Securosis’ policy of not being vendor-specific, I won’t mention specific models, but if you have this kind of requirements you should check them out. Share:

The winter holidays aggravate me. They are a consumption binge, and I know we all want a healthier global economy (which includes folks spending money they don’t have on things they don’t need) but it still irks me. I grew up modestly in a single-parent home, and we did stuff, but not a lot. We didn’t have the fancy things, which forced me to go out and earn whatever I’ve gotten. I remember being ecstatic one Hanukkah when I got a plastic briefcase-type thing to bring my books to school. We didn’t get 8 gifts or have a big-ass tree with all sorts of goodies under it. We got one thing and it was fine. I know how hard it was for my Mom to even provide those little things, and how hard she worked. That awareness has always driven me. I’ve been very fortunate, and we can provide plenty of gifts to our kids over the holidays. And we do. And the grandparents do. And they get lots of stuff from their cousins. The list goes on and on. But in the back of my mind is a fear that the kids don’t appreciate what they have. We have had to threaten to take all the stuff out of their room more than once, when they act like spoiled brats. I do try to lead by example. They see that I work a lot, but I’m not sure they understand that just working hard might not be enough. That they’ll have to find their talent, be persistent, and have a little luck, to achieve and earn everything they want. Though at times we get a glimmer of hope that despite their very comfortable lifestyle the kids have some perspective. When we got back from our holiday trip, the Boss sat down with XX2, who had a pretty interesting question. XX2: Mom, am I spoiled? The Boss (TB): You tell me? Do you think you are spoiled? XX2: Yes. I have everything I need, and get pretty much everything I want, so I guess I am spoiled. Win! Of course just because one of three understood, at that moment in time, that she has it pretty good, doesn’t mean she won’t be squealing like a stuck pig the next time we won’t buy something she wants when she wants it. But at least we can remind her of this conversation to introduce some perspective. It’s a fine line, because I work hard and have earned a certain lifestyle. I shouldn’t have to sacrifice having some nice things to make a point to my kids. But ultimately it’s our responsibility as parents to make sure they understand that the world is a tough and unforgiving place. Which means at times I need to be a spoilsport and say no, even when I get the cute pouty face. But that’s a lot better than allowing my kids to be soft, spoiled, and unprepared to deal when they leave the nest. -Mike Photo credits: “spoiled” originally uploaded by Kim ‘n’ Cris Knight Heavy Research We’re plowing through the latest Quant project on Malware Analysis. Here are the posts over the past week: Static Analysis Dynamic Analysis The Malware Profile Defining Rules You can find all the posts on the Project Quant blog. We are also finishing up our Network-based Malware Detection series. You see a trend here? Yep, it’s all malware, all the time. Here are the posts so far in that series, which we will wrap up this week. Introduction Identifying Today’s Malware Where to Detect the Bad Stuff? In case you aren’t interested in our Heavy RSS Feed, where you can get all our content in its unabridged glory. Incite 4 U The Sound of Inevitability: Kevin Mandia says if you are targeted by an advanced attacker, you will be breached (pdf). That’s not when, not if. And he should know – his firm spends a lot of time doing high-end breach response. If the effectiveness of targeted attacks by knowledgable attackers is approximately 100%, do you just accept this as an inevitability? Or do you ratchet up protections to make it harder for attackers? Those are the basic questions – they are the two most common CEO responses to this type of choice. Do you just accept this as part of the business landscape – cost of doing business – or are you determined to be a faster than the other gazelles competitors for the lions attackers to eat focus their intensive and persistent efforts on. Or maybe you can compartmentalize damage – knowing some user will inevitably click an email link with targeted malware – to just the mail server or select employee systems? It’s a worthwhile read: he lists all the data we repeatedly say you should keep – but which companies don’t have, can’t find, or take a week to recover. Breach preparedness drills? Anyone? – AL Brute force still works: King Krebs does some very interesting research into how the bad guys are defeating tests to figure out whether forms, etc. are being filled out by bots or other automated mechanisms. Basically, they’ve built sweatshops where all folks do is fill out CAPTCHAs and respond to other tactics to bypass bot detection tests. Even better, these folks have basically built a multi-level marketing scheme to get other folks to fill out the CAPTCHAs. The folks at the top of the pyramid can make real money, while folks at the bottom might make $3/day. Not unlike other MLM schemes, I guess. It’s just interesting to see tried and true business models applied to computer crime. What’s old is new again… – MR Nothing to see here. Really! Last week I got a call from a reporter at a major publication I have worked with in the past, to ask about some Symantec source code hackers claimed they stole from the Indian government and then posted online. Normally when something like this happens and the vendor denies it’s