Research

I love Mythbusters; and before every show there’s the obligatory warning, “Don’t try this at home. We’re what you call professionals”. Which is really disappointing since I now have no idea what to do with the 500 lbs of explosives, the crash test dummy, and the balistics gel sitting in my garage. This morning Martin reminds me that I’m a bit of a professional myself. As mentioned in this post, I’m running Vista and an XP machine without any antivirus. And as kwismer pointed out in the comments, Vista isn’t completely immune. I can only do this because I’m a highly educated user, only taking risks for myself, with a strong track record of never being infected. History, experience, and training allow me to take actions that are high risk to someone without my background. It’s the same as my rescue activities- the odds of me getting hurt while snowboarding some 300 lbs behemoth in a plastic sled down a black run are smaller than the odds of you blowing a knee on a blue run. Actually, the odds of me fracturing my shoulder while flying down a solo bump run are much higher than if I was doing the same run with a patient strapped in a rig behind me. Know your own risks and make your own assessments; and if you don’t have the skills to even do that accurately, always err on the side of caution. And never place others at risk even if your personal risk is low. Don’t be an idiot. I’m a professional. Share:

I have been told to no longer cover technology issues on my personal blog (that’s this). Unless/until circumstances change I won’t be posting anything related to technology or that could be construed in a way to potentially violate this policy. I will continue to occasionally post on non-technology security (and other) issues, but my rate of posting will obviously decline significantly. I won’t be offended if you drop me from your RSS reader or blog roll due to the change in content. And please, no comments on this one- but feel free to email me personally. I’ve enjoyed my time as an IT security blogger and am sorry it’s coming to an end for now. Share:

I’ve been running my eval copy of Vista (as a virtual machine) for a couple of weeks now and it’s a strange feeling. No, it has nothing to do with the new user interface (most of which won’t run in my virtual machine anyway), User Account Protection (UAP), or any of the new features. It’s because I’m running without any AntiVirus running. At all. And I can’t, for the life of me, think of any reason to install it yet. It’s there. This little zip file sitting on my desktop trying to tempt me into releasing it from the confines of its uninstalled bundle. It calls to me as I sleep, whispering fears of sending Office macro viruses to my family or being unprepared as that just-detected 1-day worm wheedles its way past my firewalls into the heart of my OS. But I resist the temptation as I banish the file to the depths of a subdirectory. Waiting to be called upon when needed, but imprisoned in the bowels of my file structure until the most desperate of times. As someone who practices safe email and browsing habits I often wonder if I need desktop AV at all. I don’t run it on my Mac and I don’t run it on my XP Home PC (that isn’t ever used for email or inappropriate browsing). I only use it on my corporate desktop, where it’s never found anything despite destroying my system performance every Wednesday at lunch, and I’m well protected with our email server AV (which is definitely necessary). Thus there’s no reason to run it on an OS for which there isn’t a single known worm or virus. It’s not like signature-based AV will catch any of the rumored 0days floating around, and my generally safe browsing habits limit my exposure anyway. I’d consider this feeling of freedom strange if I haven’t been experiencing it on my Mac for the past year. Now you Windows users can know what freedom really feels like. At least for now… Share:

Back before Gartner I ran my own consulting/development business for a while. It was reasonably successful, but when a better opportunity came up I shut down operations and joined the company that Gartner eventually acquired. I closed the business about 7 years ago. There are no remaining bank accounts, domains registered to it, business licenses, or anything else possibly connected to it. The old domain name still exists (registered to me personally) since it’s my permanent email, but the website forwards to my joke evilsquirrel site. I ran the business out of Boulder and have moved twice since then, with neither address being associated with the dearly departed corporation. Thus, for the life of me, I can’t figure out why Capital One is sending my dead business credit card solicitations to my current residential address. As far as I can tell there must be some database somewhere with the remnants of the old corp, tied to my SSN (as President and CEO), and they naturally assume I might want one of their credit cards. They’ve connected this with some current database of addresses and tracked me down as an individual to my current address. Don’t you think their fraud systems might consider offering credit to an unregistered, unlicensed business a bit of a risk? And you wonder why we have an identity theft problem?!? It has nothing to do with the Internet, and everything to do with easy credit and abuse of our personal information and databases by financial services. Share:

No, I’m not calling all security researchers torturers. Before you flame me, read the post… Not that I have any personal experience (beyond sitting through Black Dog the day my girlfriend dumped me), but torture is one of those things that rarely seems to give you the results you want, and even when it seems to work comes at an incredibly high cost As I mentioned in the Three Dirty Secrets of Disclosure post, full disclosure, especially “no-knock” full disclosure (releasing everything before even reporting it to the vendor) helps the bad guys more than the good guys. End users don’t have the time or skill, in most cases, to protect themselves. They’re still beholden to their vendor to provide a solution, but now even the lesser-skilled bad guys have a new way to attack. So how is full disclosure like torture? It’s more valuable as a threat. Once used, you can’t take it back, it rarely gives you the results you want, and everyone involved is hurt. Actually, unlike torture full disclosure hurts any innocent bystanders in the process. Some researchers think full disclosure forces vendors to respond and patch. Maybe; but in my experience vendors resist torture like James Bond and end up escaping and just getting really vengeful in the process. I think we need full disclosure as a tool in our arsenal, and that most of the researchers dropping these vulnerabilities think they’re doing good, but full disclosure needs to be a last resort- not a first strike. It’s more powerful as an ever-present threat hanging over the heads of the most unresponsive of vendors. Dropping vulnerabilities and proof of concept code on a daily basis just hardens the vendors and lets them paint you as an out of control rogue. You might think you’re saving the free world, but you’re no Jack Bauer. Share:

Being on the road this week, I missed the latest drama at the Month of Apple Bugs pointed out in this post by Chris Pepper. (One thing Chris doesn’t mention is that this backdoor was only included in a pre-release version of the exploit, not the released proof of concept code). I read LMH’s response and explanation, spoke with him directly, and feel he’s unfortunately damaged the reputation of the already controversial project. Basically, LMH found some individuals scanning the directories where he posted the exploit code samples before the accompanying blog entry was posted. There were no pointers to these files. He included the backdoor code in a file put at that location that the people scanning his server picked up and, in some cases, executed. His goal was to identify these individuals and prevent further looping of his server. I think it was a bad idea, but the backdoor code was not in any released version of the exploit. Basically it was some wacky arms race- with the individuals downloading the code poking around someone else’s server, and LMH taking a vigilante-style response. As I’ve said many times I really don’t like dropping 0day exploit code; it damages the innocent more than the guilty. But if you are going to drop code as part of a full disclosure, it should be to prove the concept and allow people to test and evaluate the vulnerability. Your code should never make the situation worse, no matter what kind of point you’re trying to make. Putting in a backdoor to track and expose who downloads the code, released or not, is never the right way to go. It’s unethical. LMH responded on his blog: The disclaimer is clear enough, and if they go around downloading and voluntarily executing random code (read, a exploit), it’s certainly their responsibility to set up a properly isolated environment. Otherwise you’re total jackass (although, why would you “worry if the bugs are fake”?). Yes- you should set up a test environment before messing with ANY exploit code. I blew 4 hours this weekend fixing my Metasploit copy (still can’t get msfweb running) and creating virtual targets to test a new exploit someone sent me. Then again most people can’t virtualize OS X legally, requiring you to buy a spare Mac to test anything. That said, I don’t think anyone ever has the right to place backdoor code in anything. If you want to track who is downloading or leaking pre-release code you track audit logs or take other actions on your end. You have no right to do anything malicious to someone else’s system, even when they aren’t playing nice. This did nothing but hurt the project. Apple security is a serious issue that needs real debate, but games like this destroy credibility and marginalize the individuals involved. Vendors generally dislike security researchers as it is. Giving them any opening, no matter how small, makes it that much harder on the research community. It allows PR departments to make a legitimate researcher look like nothing more than a malicious criminal, demonizing them in the press even when they play strictly by the book. I don’t consider LMH malicious at all; and after a few conversations have no doubts his goal is to improve security, but I do disagree with his methods on this particular project. Security researchers need to have exceptional ethics to withstand the vendor attempts at marginalization or all their work goes to naught. Share:

Tomorrow morning I’m off on the wonderful 6 hour flight from Phoenix to Boston I probably don’t have time to meet up, but if any of you are in the area and want to give it a shot let me know. Share:

The BCS Championship is in Phoenix tonight (that’s the college football championship game for our overseas and raging-geek readers) and Ohio State seems to have brought around 60,000 of their fans into town. A couple of buddies of mine from Colorado are in town for the game and we spent the weekend out and about. Last night we were heading into one of the bigger Buckeye bar-parties in town and I was totally stunned when it came time to give the bouncer our IDs. As everyone walked up he grabbed driver’s licenses and ran the mag stripes through a handheld scanner. Being both moderately sober and the security paranoid I am the conversation went like this: Me: So, are you just checking for fakes or storing any of the info? Bouncer: Both, it’s mostly for our database statistics. Me: Like how many people came in? Bouncer: Just your name, date of birth, and driver’s license number. Me: Ah. Umm… Okay. Any chance you can skip it and just give my ID a visual check? At that point he, looking like I was some Unabomber-like freak, checked my ID the old fashioned way and let me in. Of course, while watching him I noticed that he was so intent on scanning IDs into his little machine that he sort of, you know, didn’t check the faces of people handing them over. That might explain the one 20 year old girl running around stealing drinks, grabbing any guy within reach in a manner that’s rarely free, and putting the Vegas showgirls to shame. I can’t really think of any good reason a bar named Mickey’s Hangover needs that info. And in the process they reduced their security by relying on a machine to find fakes, and forgetting to see if the ID handed over even slightly resembled the patron at the door. Seriously folks- I don’t think I’m overly paranoid, but it’s hard to justify letting a random bar keep my vital stats just to buy an overpriced beer. Share:

I’m catching up from being out (or sick) most of the holidays, so this is a bit of old news. Dave Maynor is no longer with SecureWorks (his decision) and has joined us in the blogosphere over at Errata Security (his new employer). I suspect he’s still bound to keep details of the Mac WiFi fiasco under wraps, so don’t expect any new insight on that issue. He also got a bit of fame in this article. Dave’s a good guy who got caught in an extremely bad position. It’s nice to see him in public again, and nice to see another professional researcher hit the blogs. In the past he’s been against full disclosure, so it will be interesting to see how he reacts to the Month of Apple Bugs after his recent experiences. Share:

I had the opportunity to review Rothman’s Pragmatic CSO before the holidays, and it got me thinking about complexity. (Oh yeah, and it’s really good, but I’m not allowed to endorse anything so that’s all I’ll say.) One thing I realized after spending a few years wandering into people’s homes and vehicles during the most stressful events of their lives (legally, being a paramedic and all) is that we have this incredible ability to make our lives more complicated than they need to be. It’s as if the human creature, by din of our apparently complex consciousness, builds nearly insurmountable mental constructs that shield us from that which is straightforward and simple. It’s like our brains are these high performance sports cars that just have to run at full speed no matter what the road. And let’s be honest, not all sports cars are built alike, sending those of lower performance flying off the cliff edge of intelligence to land in a mangled heap when they hit the hard pavement of reality. Time and time again I saw people sometimes destroy themselves by failing to follow the path of simplicity- sometimes losing a relationship or their long term health, other times losing their lives. Come on, you all know the drama kings and queens that crave complexity in their lives despite their protestations for the contrary. Or the motormouths that keep their lips moving to prevent theirs brain from having a moment of quiet reflection to show them how much they’ve screwed themselves up. We (and I really mean we; all of us are guilty) often make similar mistakes in the professional world. We spend more time building an RFP and testing each widget in a product than we’ll actually spend using it, totally ignoring the fact it doesn’t have the one critical feature we really need. We spend more time building frameworks, models, architectures, and checklists than building the necessary systems. I’m not saying we should toss all paperwork and planning to the winds, but we very often lose perspective and create unnecessary complexity. Just look at the COSO ERM framework as the shining example of CTSCS (crap to sell consulting services), or the government paperwork bottlenecks of accreditation and certification. In mountain rescue our goal was to keep every rescue system and operational plan as simple as possible- because the more pieces you add to the chain, the greater the likelihood of failure (literally). I like Rothman’s work because he’s trying to pull us back to basics. Yes, we need assessments, strategies, policies, and plans, but the practicality of security is complex enough as it is; we shouldn’t let the business of security compound the problem. We need to be realists and know that we’ll never solve everything, but by focusing on the pragmatic, simple, and direct we can best protect our organizations without going totally batshit. Don’t make life harder than it needs to be. Don’t add complexity. Keep it real. One of the best ways to be effective in security is to look for the simplest and most pragmatic solutions to the complex problems. Share: