Research

You Apple geeks may have noticed I’ve been writing more over at TidBITS, that’s where I tend to put my less-technical Mac articles, especially those that aren’t about security. This week it’s more on the Leopard firewall. It’s less technical than my summary here, but goes into a little more depth. Overall I think it’s been blown a bit out of proportion- I don’t consider the firewall enough of an obstacle that you shouldn’t upgrade, but you do need to understand how it works and we all need to keep the pressure on Apple to clean it up. Share:

I’m almost done with my deeper review of the firewall, but discovered something ugly in the process of podcasting and firewall testing. If you enable the firewall in the “Set access for specific services and applications” mode, Leopard digitally signs applications on launch that aren’t already signed via Apple’s mechanism. If that application happens to change during runtime, as Skype seems to, the signature no longer matches and the application won’t run. There are no dialogs or warnings- the icon just dances on the dock for a few bounces then disappears. I went to podcast last night and had this happen. Reinstalling it fixed the problem, but then it hit again today. I looked in my console and saw the following: Nov 1 16:09:34 CrashBook [0x0-0x27027].com.skype.skype[387]: Check 1 failed. Can’t run Skype Googling that error returns some threads in Skype forums that indicate this is a known issue related to the firewall and code signing. A reinstall fixes it, but this is, obviously, a bit of a problem. I’m somewhat surprised this hasn’t made the rounds yet. Share:

Updated: See http://securosis.com/2007/11/15/ipfw-rules/. I just spent entirely too much time digging into the Leopard firewall, and here’s what I’ve found. The less geeky version will be out on TidBITS (probably tomorrow); this is just the summary of actual behavior: “Allow all incoming connections” allows all- no surprises. In all firewall modes, if you don’t select Stealth mode, mDNS (Bonjour, 5353/udp) is open on a port scan. “Block all incoming connections” does seem to block actual connections, but any shared ports are detected as “open/filtered” on a port scan. In “Block all” mode with stealth mode enabled, those shared services no longer show on a port scan. Once you connect to another computer (outbound), Kerberos (88/tcp) is open and stays open no matter what you change on the firewall, including enabling stealth mode. This disappears on reboot. Other services may exhibit this behavior. If you choose “Set access for specific services and applications”, any time you launch a program which starts a listner, the system automatically pokes a hole in the firewall to reach it listeners, but only those in the Sharing preferences pane appear in the list of services. This rather defeats the purpose of the firewall, since any listener is automatically accessible! That mode is labeled differently in the help file than on the screen. In the help file, it’s “Limit incoming connections to specific services and applications”. Just a nit, but that seems clearer to me. At least they warn us if you dig into the help: IMPORTANT: Some programs have access through the firewall although they don’t appear in the list. These might include system applications, services, and processes (for example, those running as “root”). They can also include digitally signed programs that are opened automatically by other programs. You might be able to block these programs” access through the firewall by adding them to the list. “Set access” mode seems incredibly inconsistent- some applications require you to authorize network connectivity on launch, and others don’t. For example, Skype and Firefox asked me for access, but Colloquy and Twitteriffic didn’t. If you are asked to authorize an application and let it connect to the network, the binary is automatically signed by the system if it wasn’t already. If that application changes, it breaks and won’t launch. You get no warning or indication that this is why your program no longer works. I only stumbled across an oblique reference in the console. If you open Sharing, but set “Block all”, your computer still appears on the network via mDNS, but no one can connect. Annoying. I feel like I’m missing something, but I think that’s it. In short, block mode seems to block inbound connections but ports show as open/filtered. Stealth mode works, partially, but some ports still show on a port scan no matter what (like Kerberos). Bonjour is ALWAYS accessible, unless you’re in stealth mode. Application (“Set access…”) mode is a mess- code signing breaks applications, and the behavior is inconsistent. Any launched services are authorized and you can’t change the settings in the firewall GUI. The good news is that ipfw is still enabled and you can manually configure it or use a GUI like WaterRoof. Looking at how all this works I can see what Apple was thinking, even though they made many bad decisions. When block all is enabled it does seem to block most traffic, but instead of leaving ports open/filtered it should close them, not show them as filtered (I suppose not everyone will agree; feel free to say so in the comments). Stealth works, mostly. It’s hard to tell without playing more, but I think the Kerberos issue is related to outbound services. I suspect (thinking back to how Kerberos works) that it must open an outbound port to authenticate a session when you connect to a remote server. The firewall allows this since it was initiated locally (thus implicitly trusted), but the Kerberos implementation probably doesn’t tear down the port when it’s finished and the firewall still sees it as authorized for return traffic. Just a guess, but this could also explain some behavior noted elsewhere. This should address the findings in the heise security article which inspired this research. They just seemed to miss enabling stealth mode and I’ve added a bunch more on how application control works. I’m done with the firewall for now- it took far too long to run all the scans in all the different modes just to come up with a few bullet points! Share:

I was reading this post by Richard Bejtlich and it reminded me of a little pet peeve. It seems some people out there criticize Richard for focusing more on external threats than the big bad, “internal threat”. I’ll admit I used to use the term frequently when I was a little naive, but I finally realized it became code for “scary stuff you’ll never be able to protect yourself from without spending a lot of money on our products.” Yes, there is an insider threat, but we abuse the heck out of the term. There are a few principles I like to keep in mind when discussing the insider threat. Some are a little redundant to make a point from a slightly different perspective: Once an external attacker penetrates perimeter security and/or compromises a trusted user account, they become the insider threat. Thus, from a security controls perspective it often makes little sense to distinguish between the insider threat and external attackers- there are those with access to your network, and those without. Some are authorized, some aren’t. The best defenses against malicious employees are often business process controls, not security technologies. The technology cost to reduce the risks of the insider threat to levels comparable to the external threat are materially greater without business process controls. The number of potential external attackers is the population of the Earth with access to a computer. The number of potential malicious employees is no greater than the total number of employees. If you allow contractors and partners the same access to your network and resources as your employees, but fail to apply security controls to their systems, you must assume they are compromised. Detective controls with real-time alerting and an efficient incident response process are usually more effective for protecting internal systems than preventative technology controls, which more materially increase the overall business cost by interfering with business processes. Preventative controls built into the business process are more efficient than external technological preventative controls. Thus, the best strategy includes a mix of technology and business controls, a focus on preventing and detecting external attacks, and reliance on a mix of preventative controls and detective controls with efficient response for the insider threat. I really don’t care if an attacker is internal or external once they get onto a single trusted system or portion of my network. The “insider threat” isn’t a threat. It’s become a blanket term for FUD. Understand the differences between malicious employees, careless employees, external attackers with access inside the perimeter, and trusted partners without effective controls on their systems and activities. Share:

From Chris Pepper: His TidBITS article on SSL A post on some handy commands Chris is my first resource when I need help with the command line. On a separate note, Chris managed to hit his goal of 1500 bug reports before the release of Leopard. Very cool. Share:

Just a quick note that I have a short article up on Network World on DLP. I answered the question, “With all the recent news about acquisitions in the DLP space, I’m unsure if now is the time to select a solution or if I should wait. How can I tell the right time to get into DLP?” A short clip: The decision to invest in Data Loss Prevention (DLP) should be based on how ready you are as an organization, not the internal wranglings of a young market in the midst of a growth spurt. I like to describe DLP as an adolescent market- it’s one that provides high value even though the market and the solutions aren’t as mature as some other areas of technology. (Full disclosure- I was connected to Network World by Reconnex, but I don’t currently have a business relationship with them and I was not paid by anyone for the article). Share:

Okay, it’s not that scary, other than the fact Martin isn’t even in the episode this week. That’s right, I flew solo and invited Glenn Fleishman from TidBITS and Wi-Fi Networking News to join me in an episode dedicated to the security issues around the release of Mac OS X 10.5 Leopard. Glenn Fleishman is a TidBITS contributing editor and a Seattle journalist who covers technology for publications like The New York Times, Popular Science, and The Economist. He blogs daily about Wi-Fi and other wireless networking at Wi-Fi Networking News. Glenn lives in Seattle with his wife Lynn, sons Ben and Rex, two iPhones, and a dozen Macs of various vintages. This is one of the most significant updates to the OS X series of the Mac operating system, with more dedicated security updates than any other version. But although Apple clearly invested in security, they didn’t necessarily finish the job. A combination of incomplete security feature implementations and some new operating system features with security implications make this a release for us security geeks to keep our eyes on. Show Notes: Rich’s pre-release TidBITS article on Security Improvements in Leopard Thomas Ptacek’s article evaluating the Leopard security features, post-release The ISFYM (Internet Security For Your Mac) post on Back to My Mac security problems by Open Door Networks Leopard firewall article from Heise Security Rich’s follow up article on Leopard Security Network Security Podcast, Episode 82, October 31, 2007 Share:

We have some guests in town so it will be a couple more days until I’m back to the regular blogging schedule, but I did manage to install Leopard this weekend. As an OS, so far it looks great. The upgrade went without a hitch and everything seems to be working well. I still need to dig into my Unix tools and the less-frequently used applications, but the day to day stuff is all working fine. The security updates are a bit of a mixed bag. Tom at Matasano posted a really good technical summary of how Apple implemented some key new security features. I’ve also talked to a couple other researchers who have dug in. The summary is that Apple is dipping their toes, but needs to fully implement the features if we’re to see the security benefits. Library Randomization seems to be only a partial implementation. Check out Tom’s details, but I validated this through another source and it’s unlikely this will offer the buffer overflow protection we’re looking for. As Tom describes, it’s more of a speed bump than a wall. The firewall may be better, but we’ll never know. The user interface is so simple as to be nearly useless and despite the simplicity is more confusing. It’s all or nothing (block all incoming connections, or allow all incoming connections, or select applications to secure). Later this week or next weekend I’ll have time to play with it more, but the firewall changes don’t look good and may place more people at risk. There are a bunch of other implementation problems. I’d say, right now, my earlier statements that this is the most significant security improvement in the OS X line are premature. The components are there, but the execution is off. It’s nothing they can’t easily fix in some regular updates, and we (the customers) need to stay on Apple to finish the job. Share:

It hasn’t taken long, but I’m a Twitter convert. I didn’t realize how useful a short-message broadcast tool could be, especially one linked to mobile phones and IM with a persistent web page. No, I don’t really care what people are eating for lunch, but as Threat Level reports, it’s become amazingly useful in dealing with the California fires. I’ve been on more than my fair share of disaster responses, and would have killed for a tool like this. The ability for people to register their wellness and location in one central location, as supported by Twitter and the Red Cross, is simply astounding. Tracking people and families is one of the most difficult aspects of disaster response. At Katrina we had to do things like pack entire families (of 11) into a single ambulance if one person needed medical care, because you never knew where someone would end up and if they’d be able to find their loved ones again. Cell phones were the first technology tool of recent days to really impact emergency services and crisis response. Remember the days when you’d have to drive to the next exit and find an open gas station to report a highway car accident? At Katrina those with cell phones were essentially 100% likely to find their families, while those without waited weeks or months for word. IM and email showed themselves as essential tools on 9/11. It was through email, an asynchronous communications channel, that I was first able to get word from my friends in New York (I think Chris Pepper was the first to give me an update). Once the initial wave of panic ended, I was able to communicate via Instant Message long before the phone lines freed up. Text messaging is also often more reliable, since it’s asynchronous and on some phone systems uses dedicated channels that aren’t as degraded by large call volumes. Twitter is now on the list- it combines many of the best factors of email, IM, and cell phones. You get asynchronous communications that can queue and still deliver within a reasonable time, persistence via a web page, broadcast to large groups, private messaging, and burst traffic that doesn’t require as much bandwidth. Twitter also leverages multiple channels- a key factor in any emergency communications tool- IM, web, and mobile phone. Next time I deploy, Twitter will be where I send my family to track me. Read the article. Share:

Good news for Provilla, but this one could go either way on the whole good/bad scale. I’d heard some good things about Provilla’s technology, but if Trend thinks they can solve this with an endpoint-only solution they won’t succeed and those with hybrid solutions will trounce them. Thoroughly. I wonder how much they paid? Share: