Reliable IOS Exploitation

FX has given a comprehensive talk about IOS exploitation (including even TCL scripts operators leave behind when they moved jobs to retain access).

He has shown effective and ineffective ways of detecting compromise in IOS.

Then, he has shown how reliable exploitation of IOS routers works.

His talk will probably be downloadable from the CCC (25C3) web site by tomorrow.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Attacking a Critical Internet Infrastructure

Hi folks and happy new year!

I am writing to spam about a talk about to be given at the CCC conference (25c3). I apologize for the cross-posting.

At the 4th day of CCC (30th), there is an interesting as-of-yet no details disclosed talk by a couple of good people.

http://events.ccc.de/congress/2008/Fahrplan/events/3023.en.html

Making the theoretical possible
Attacking a critical piece of Internet infrastructure

* Jacob Appelbaum
* Alexander Sotirov

There are no details provided on the web page which means both good and bad things depending on your point of view. Regardless, if you are not down here I'd
tune in to the web casts if you have the time. It's bound to be _very_ interesting.

Live streaming information can be found here:
http://events.ccc.de/congress/2008/wiki/Streaming

Gadi Evron.

Follow me on twitter! http://twitter.com/gadievron

ISOI 6, Dallas TX - 29,30 January. Agenda and details

Hi all. ISOI is once again happening, and back to the States.

Almost final agenda: http://isotf.org/isoi6.html

As usual, while attendance is limited to the folks who are busy "saving the Internet"/"fighting crime", it is free of charge.

Once again we offer the public at-large the opportunity to attend without such membership. The process is: you submit a relevant talk, get vetted and get accepted.
We have two slots reserved for such a purpose.

Subjects of interest: case studies, attacks, botnets, fraud, ...
To submit email your talk idea to contact@isotf.org.

Is it time to say merry Xmas yet?

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

BNP (British National Party) membership (supposedly) has been leaked

By tomorrow morning the web will be full of rumors that the membership list for the BNP (British National Party) has been leaked. I can not verify the list is true, but I can verify it is out there.

This was "spammed" earlier today on the criticalsecurity.net IRC server and channel:

http://bnpmemberslist.blogspot.com/
http://bnpmemberslist.blogspot.com/
http://bnpmemberslist.blogspot.com/

burn, f-er (censored by blog admin:)

Shortly later it was seen on the infamous /b/. An extremely popular image board, usually full of pornographic content. One of the more hellish areas of the web.

Obviously this content is being actively pushed on the net, and we have seen what happens when content is attempted to be censored on the Internet (a lot of lawyers waste a lot of time).

If this will prove to be true, this is yet another example of how your information is pretty much everywhere, any any one of these many places can get hacked.

This happens on occasion even with the most serious security measures put in place, so what of most of these organizations with your information, of which security is not up to scratch?

The blog holding the information and being pushed on the web is: http://bnpmemberslist.blogspot.com/

Another URL is of an SQL database holding the data, but I feel mentioning it here is effectively sending the data across on my own, which is less than ethical.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

All Hallows' Eve: Is There a Special Fire Code for Cemeteries in Poland?

[syndicated from my fun blog]

This post is about All Hallows' Eve as I experienced it in Poland, about remembrance, and the unseen economic forces I observed behind the scenes.

As part of my trip to Poland (which I will cover in a later, much happier, post) I met with Ela, whom I had briefly met before in Israel. She took me to a local cemetery for All Hallows' Eve. It was an uncomfortable walk, an emotional visit and a place where many background things showed themselves, and how they may be quietly, economically, impacting the world.

Ela is an ideologist with strong opinions and refers to herself as a "dissident". Highly loyal to her country (yet not afraid to be a critic) she works to right wrongs and protect the weak--Anywhere. She has an agile mind, but is so "on target" that she can at times miss the obvious, but not for long, and despite being moved by her emotions, she recognizes cold reason when presented to her.

I had a lovely meeting with her, but before we could sit and chat she insisted on taking me to a nearby cemetery. I'll first describe what was seen, and then what I saw--The hidden economy of life, and I suppose in this case, of death.

Being religious, Ela doesn't appreciate Halloween, as she sees it as a caricature of her worship. Demeaning the day in which she remembers those who have passed, inverting its purpose of self reflection. Being open-minded, she doesn't care if others celebrate Halloween in the now replicated "American" way (even me, partying here in Israel or there in Poland) but it's not for her.

First laying eyes on the cold stone fence and the tombstones behind it, I sighed audibly. What a waste of time. And of effort--To be polite. Yet, I was there. And as I was so was I now intrigued.

What I saw in the cemetery moved me. Hundreds if not thousands of graves, all of which with but few to many dozens of lit oil lamps (and some flowery plants) placed on them, displayed for the world to see. Strife and opinion put aside, Poles all go to the cemeteries that day to show respect, and remember. That, or in all likelihood their parents make them--No matter how old they may be--Much like they will "ask" their children.

Looking into the night I saw lights in the darkness, some twinkling behind a tree, others lined up to the distance. All carefully placed by the multitude of those who probably never even spoke to each other, all for the same reason, remembrance--resonating deep within me.

Not knowing the right etiquette, I still commented to Ela "let's not walk on the grass," there is something about such places that you simply know.

I am not one to get in touch with the holy feeling of any place, and I am one to get bored in museums (barbarian!!). Yet, even if moving between the graves was just going through the motions and feeling a bit odd--The multitudes, be it of people or of lamps, had me wondering all the while I was wandering, truly aimlessly and with bright eyes, on the beaten track.

There were some secrets to the cemetery.

Some, were obvious. I'd ask "Ela, what of the odd grave every once in a while with no lamps on it?". These felt so lonely. And she'd reply "these people probably have no relatives in town, or at all," I'd nod thoughtfully and she would go on "we have no family in town, either. So, we go to a grave with no lamps on it and place ours there. Elsewhere, someone does the same for our relatives' graves. We respect our dead, and the dead who have no one to come to them."

It's a win-win situation, you see? :)

Others, were obvious, and probably also noticed. "Ela," I'd say, dropping the extra "sexy" I often add when addressing her. She'd reply "Yes, these massive hills of garbage" at the entrance of the cemetery, mind you "...are in poor taste!"

I agreed, but couldn't help but comment after a moment of thought "and yet, there is order to the chaos. There is no garbage thrown on the grounds, anywhere."

The cemetery itself would put even Buffy's local cemetery in Sunnydale to shame, but it wasn't creepy. It was a place of memory, stones, and green grass. Yet the grass isn't always as green as your neighboring grave's, as you well know. Walking deeper into the cemetery, the previously clean tracks between graves were suddenly so full of leaves from the Fall that you could hardly step on the Earth.

A sign of decay? A show put on for the outside? A lazy keeper? More trees in that area? We didn't stop to check.

That area was darker, and also had significantly less graves in it. It had a monument on one side, and a large cross at the other. One was for the fallen soldiers who fought the Nazis during World War Two. Another was for the fallen in the resistance against the Nazis. Another monument was for the fallen in the resistance against the Soviet Union.. many of whom were members of the first resistance, but non survived many years into the occupation. This made this monument one for those who were "disappeared" during the reign of the Polish satellite state of before the collapse of the Soviet Union.

Each monument, or cross, was a mass grave. I didn't quite grasp that while staring into the darkness of grass with no graves on it.

Once I came over my half-shame at thinking about it, the patterns in which people placed the lamps on the graves caught my attention. Some were just put there in seemingly random placing. Others were immaculately placed. Some were on the ground, others on the tombstones.

Why half ashamed you ask? Well, I voiced the thought when we passed a double grave (probably for a husband and wife). There were big red lamps placed in a line right between the graves, separating them and other lamps put on both graves. "Probably trying to separate them from fighting beyond the veil." I joked, unsure how Ela would react.
:)

Looking at the cemetery and the.. event.. show.. taking place in it, with an economic eye, the market which formed outside, selling lamps, flowery plants and food, was probably a boost to Poland's economy that day, kind of like on the 4th of July in the States. A big business--People are dead, but there's a bright side! Right? ...?

More interesting though was the thought of the Warsaw Fire Department. I would really like to know what they were doing that night, and how many calls they received. Is there a special fire code for cemeteries, in Poland?

It reminded me of the potential for fire and how the Fire Department is aligned to cope with it, here in Israel for Lag BaOmer (a holiday where everyone and their sister lights a bonfires, all around the country (emptying every construction site of wood while they are at it, up to the point where these give away wood they buy especially just to keep themselves afloat).

I was there to experience Poland and its people (in the few days I had after my lecture), unlike many Israelis who go to glimpse what the holocaust left behind. While most of my trip was fun and games, I am glad Ela took me on this.. adventure? I am glad that I went, however unwillingly.

This was an interesting, touching, experience. One which I doubt many Israelis who visited Poland had experienced. Thank you Ela.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

When First Blogging (Spam-y Behavior)

[syndicated from my fun blog]

When I started blogging I made mistakes. What I learned was not about security, or writing--That came later. I learned about how to balance my presence in online communities with my blog posting--Without unintentionally being an annoying spammer.

Seeing a friend post to communities I am a member of in the past few months and repeating my mistakes, annoys me as much as spammers do (much like I used to annoy others). I searched for an ancient post of mine on the subject and here it is, updated.

Part I: How do I balance my blogging with my communities?

I like mailing lists and I participate in some, depending on free time and interest. Before I started blogging, I used to be more active, and felt these different discussion forums were a home. I had a problem.

I’d start talking about something there and say to myself “hey, why not write about it in a blog?” and I would. Or the other way around, I’d blog something and say “hey, wouldn’t this interest community home #21?” :P

I went through several phases before settling down on what was best:

1. Email in that you wrote about something in the blog.
2. Email in just a bit or a summary, as you don’t want to write twice, and send a link to your blog.
3. Copy the entire blog post, and add a link (which is useful if the situation was unfolding in real time and updates to the text are expected).
4. Include a link to your blog in your signature.
5. Email in a copy, and unless you have a specific reason, don’t mention the blog.

I keep seeing other people repeating the above process (more or less), with minor variations as to which step comes first, and what is considered acceptable. Some people call them spammers, others just smile or pout. One thing is for sure, it is something many new bloggers who were part of at least one community before their blogging days, go through.

The thing is, I am my own worst critic and had to feel comfortable with posting. My solution ended up being #5 (although #4 is also okay, as critics of that one are just nit-picking flamers). More specifically, I decided:

"Stop worrying. Post what you want where you want, and try to avoid duplication. Do not mention the blog. Mention URL to the blog only when you have a reason to, such as *necessary* updates that will follow."

So, even if I did like the idea of people hearing of my blog (obviously), marketing was far from my main intent. I didn’t like the fact it ended up appearing like spam, in their eyes or in mine.

Part II: I want to "spam"! ;-)

"But." you might say "aren't there places in an online conversation where giving the URL to my blog is acceptable?"

Acceptable marketing in this case is viral, and if you participate people will find your blog. If you still want to send in the URL, make sure it is relevant.

The following are some occurrences in which it is okay to mention your URL in communities:
(Watch for the important notes and caveats later on)

• As mentioned, you can place the URL is in your signature or profile information (quite alright, but I personally avoid these 99% of the time).
• When a relevant topic presents itself, make a real comment and if, and only if, relevant, mention there was a similar incident, or you wrote about this before.
• Unique posts with new and revealing subjects are exempt. An example would be: "I am on the cover of the New York Times!!!!111".
• Similar to the above are announcements of a personal nature such a birth of a new baby girl, with pictures. Again, only if done rarely, and advisably with a direct URL.

Notes and caveats on "acceptable" exemptions:

• Timing and rarity: Don't over-do it. Post URLs only *rarely* or you may as well spam.
• Form: When you do post, a direct URL to the post is advisable.
• Relevance: Don't force it. Here's an analogy from the product world as coined by a friend on one of my ideas--"Most solutions wait for a problem. This is a problem waiting for a solution". Wait until you see a relevant pre-existing topic where you find yourself repeating what you wrote in your blog.
  
• Don't be a stranger: It's best to do so only if you are a *contributing* member.

In conclusion

I learned how to participate in these communities while having a topical blog, which for some reason originally was not straight-forward for me.

I now realize I went through the same process once before when I became active in more than one community. Learning is not an easy process, and repeating mistakes is what we are wired to do to try and make it work "this time". With it happening to me twice I was able to pinpoint what was bothering me and why, and apply the necessary changes.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Phishing Registrar Accounts - ENOM is First Target

Criminals are now looking to use established domain names, via phishing targeted at domain registrars. This is possibly related to ICANN finally moving to stop the black hat registrars of the world.

According to the first report on the matter sent Yesterday to Registrar Operations (reg-ops) mailing list, the attacks seem to be run by gang of child pornography spammers. The domain names in the .biz TLD are all using fastflux technology to make the attack more difficult to mitigate.

Ironically, the email spam claims that the user's domain, according to the subject, has "Inaccurate whois information".

Until ENOM and other registrars get their anti phishing services in place, I believe it is the job of the Internet security operations community to help them out by taking down these attacks.

The Registrar Operations group (reg-ops) will be watching for these and mitigating them as fast as possible, in close cooperation with the registrars and the security community.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

ICANN Sends Termination Notice to Registrar

ICANN sent EstDomains a termination notice:

"Dear Mr. Tsastsin:

Be advised that the Internet Corporation for Assigned Names and Numbers (ICANN) Registrar Accreditation Agreement (RAA) for EstDomains, Inc. (customer No. 919, IANA No. 943) is terminated...."

I believe this is a very positive step from ICANN, showing it is indeed an active part in shaping the Internet, as well as responsible to its constituents.

While I am sure this can not be an easy move to make, it is warranted in this case and I believe it to be a brave one. While such decisions must not be made rashly, it is my deepest regret WHOIS information is the only way to reach such ends.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Are you getting your news from spam? My mother does.

This is a story about my mother and Obama.

My mother: "Have you heard about Obama? Really impressive guy."
Me: "What about him?"
My mother: "x, y and z."
Me: "Where did you hear about this?"
My mother: "I read email too, you are not the only one who is into technology."

Luckily, my mother bases her opinion on more than just spam messages, being an educated woman. I am not sure about others.

I refused to believe this. I still do. Yet, it is true. More and more people get their news from spam, and worse--Form political opinion based on what they read in it, especially when their friends send it to them in chain letters ("hey, you have to see this!").

Be it political spam targeted to change the minds of voters, or regular malicious spam, catching eyes with political blurbs so that users will open the email messages. These messages reach people, and they read them.

I don't have exact numbers, as I am unaware of research which tried to measure it. I am however, now facing the truth. What made me wake up was my mother.

Speaking with friends, my mother is far from the only person to be influenced by such email messages, though.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

New stem cell research: "babies no longer required"

Two MAJOR leaps in stem cell research have been achieved, and published. In the past the only source for stem cells was from dead embryos, which caused many a-folk to be outraged by this use for "potential" (given, dead) babies. The moral, philosophical and scientific discussion aside, it just became much more interesting.

A year-old research declared skin cells can now be reprogrammed to act as stem cells. A new research declares stem cells can be extracted from testicles.

Study co-author Thomas Skutella, of the University of Tübingen in Baden-Württemberg, Germany, and his team isolated stem cells from adult, human testicles and cultivated them to become pluripotent cells, which can develop into many other types of cells.

While it was clear to me no ban can really stop research with such immense impact on humanity,(as well as a monetary impact on whoever holds the rights) this discovery is predicted to stop the opposition to stem cell research in its tracks. That may not be the case.

The main moral objection is that "potential humans" (babies) were used, which is no longer the case, colourful language aside. Researchers have now shown that is no longer an issue (although naturally, further research is required).

The thing is, the opposition's argument is likely to change. It is true, "potential humans" will no longer (if the research holds water) be used, but the "don't play God argument" is about to be more strongly introduced.

These stem cells can just as easily be used to CREATE babies, and that is something the true opposition won't stand for, even if they were willing to give ground on it before.

Others may realize the huge impact on humanity this research will have, or changed their minds by now due to unfortunate personal or family medical experience. There will always be an opposition, or 20. That's what so beautiful about human society--the diversity.

Gadi Evron,
ge@linuxbox.org.


Follow me on twitter! http://twitter.com/gadievron

Logical fallacies and rationalizations, cont.

I recently came across this post, which reminded me of the logical fallacies and rationalizations discussion. The post discusses a vicious murder, but also touches on the very core of the subject we discussed, with a bit on "affecting change" and getting set in your ways, traditions and taboos.

Now, disengaging from the act of murdering three girls for "free will", which naturally, is difficult to do (as if we don't, it will hijack the discussion immediately)--this post has a very interesting first paragraph:

"Whenever you hear someone defend an action with the excuse that "it is our custom," "it is traditional," "we've always done it that way," "it is written so in our sacred texts," or variants thereof, slap 'em down and spit in their eye. Those are not excuses for anything but the perpetuation of bad old dogma rather than taking the useful step of actually thinking about causes and consequences fallacious shortcut that allows ancient evils to thrive."

Affecting change and getting movement in groups is a special interest of mine. The examples given above are the illiterate answers someone may give as to why they should or shouldn't do something (except for the "because it's written" which is a whole other unrelated concept).

More literate answers do exist when you speak with intelligent people, and then there can be several reasons why they hold to their beliefs, legitimately. These taboos came from somewhere and some of them were even a Very Good Idea™ at the time. Noticing things we know to be evil no longer are is difficult. Further, our beliefs are still what in many cases defines any group and shouldn't always be abandoned just because they are not necessarily reflecting reality.

Example from my life in computer security:
Sharing virus (computer) samples is considered "evil" and irresponsible by the Anti Virus industry, for reasons ranging from fear of spreading them to helping the criminals, or giving them feedback on what we know (not to mention losing a competitive edge).

And yet the landscape changed, these are everywhere nowadays so the criminals don't need "our" samples, while many defenders do--desperately--and have no "legal" means to get the same information. Yet, is it wrong for professional anti virus researchers to view such sharing as evil?

Getting set in your ways as well as following established taboos are quite fascinating in how they form and how they can be broken. Usual annoying disclaimer: nothing is ever black and white... blah blah.

The rationalizations mentioned, however, are another facet of the same thing we discussed earlier, I think?

Gadi.

Follow me on twitter! http://twitter.com/gadievron

Information warfare and defending organizations from computer espionage

This blog post is about computer-based espionage, and how we can defend our organizations against it. But I'd like to start from a mood piece of sorts.

There has been too much noise about information warfare lately. If we put DDoS (Distributed Denial of Service) and defacement attacks (such as in Estonia [PDF]) out of mind. The following two stories (coincidentally left to rot as Firefox tabs in my browser for the past two months) give a better understanding of what it is really about, without resorting to more scary stories about what China is, or isn't, doing.

We'll also touch on other interesting cases such as the Israeli Trojan horse case, when we talk about defensive measures in defending against computer-based espionage and targeted attacks.

The first is a report (without much detail or proof) on North Korea being involved in operations against South Korea using Trojan horses for espionage:
http://www.networkworld.com/community/node/32202

The second, is a lesson from history called The Farewell Dossier.

From Wikipedia:

The Farewell Dossier was a collection of documents containing intelligence gathered and handed over to NATO by the KGB defector Colonel Vladimir Vetrov (code-named "Farewell") in 1981-1982, during the Cold War.

...

This information led to a mass expulsion of Soviet technology spies. The CIA also mounted a counter-intelligence operation that transferred modified hardware and software designs over to the Soviets, resulting in the spectacular trans-Siberian incident of 1982. The details of the operation were declassified in 1996.

The resulting explosion was so big, it was supposedly confused for a Nuclear explosion by American decision makers until the CIA said: "oh, that's one of our operations."

A quote from this article puts it in a computer security perspective:

In June 1982, in a remote patch of Russian wilderness, a huge explosion ripped apart a trans-Siberian pipeline.

It wasn't a bomb that destroyed the natural gas pipeline and sent shock waves through the economy of what was then the Soviet Union. Instead, it was a software virus created by the CIA, according to a book by Thomas Reed, a former U.S. Air Force secretary and National Security Council member.

What does this mean?

While incapacitating and destruction-based attacks are certainly of significance, and important to defend against as they impact us directly, regardless of who the attacked party is or where in the world they are (DDoS attacks harm the Internet and its' users), smarter, quieter attacks, are all around us. How do we defend against them?

I expect most information warfare acts to be targeted, quiet, and covert. Espionage, or spying if you like, is not relevant to us unless we are the target. The diplomats and the intelligence communities of different countries can figure it out for us. It is an old occupation, and well covered by international law. Computers are simply another tool, or capability, to be used by these same people. There is nothing new here as far as how the game is played.

And yet, what if you are a target?

Recognizing there is a threat

You may have to defend against computer-based espionage for your own employer. Recent case studies, as well as research, have shown industrial espionage is indeed a big deal, and here are two examples.

One famous case from a few years ago which I had the unfortunate opportunity to study, lead incident response for in the Government, and brief Fortune 100 companies on, is the Israeli Trojan horse case.

Leading IT companies (most of which were local Israeli branches of Fortune 100 companies) were spied on using a Trojan horse built by an incompetent programmer, leaving traces of itself everywhere on the affected systems. This went on for for a long period of time, undetected by any of these companies.

The issue was only detected by chance when the creator of the Trojan horse used it for his own private purposes, and discovered during the investigation into this harassment case. The stolen information was fed directly to their competitors, which was most of the rest of the Israeli IT industry. The services themselves were rendered by civilian intelligence and investigation firms.

In another case Israeli case, the attackers broke into a local branch of the Post Office (also a small bank in Israel) and placed a wireless gateway connected to a switch inside. Through it they stole a few tens of thousands of Shekels in the few days they were in operation (the Israeli Post Office is a sort of a small bank). This case was also broken by complete chance, originally, as nothing was stolen, this was to be ignored by the bank and local authorities.

In other cases, intelligence agencies for various countries, such as France as a prominent example, have been spying on their own to make sure their own local companies have an edge competing with companies from other countries.

Here is an interesting quote from "The Industrious Spies, Industrial Espionage in the Digital Age".

This transition fosters international tensions even among allies. "Countries don't have friends - they have interests!" - screamed a DOE poster in the mid-nineties. France has vigorously protested US spying on French economic and technological developments - until it was revealed to be doing the same. French relentless and unscrupulous pursuit of purloined intellectual property in the USA is described in Peter Schweizer's "Friendly Spies: How America's Allies Are Using Economic Espionage to Steal Our Secrets."

Defending against computer-based espionage

For the purpose of defense, while I'd certainly hope for more resources (read a larger budget) and change my focus on where I apply it--there is no inherent difference in how you defend your organization from computer-based espionage than in protecting against any Joe hacker.

In espionage, the attacker has more resources, both technical and operational. That is the one technical difference, others are motive and legal standing.

Some of what I would do differently

I'd concentrate a bit more of my resources on network behavior analysis (which unfortunately, not many tools exist for, so good network security analysts are the main alternative), as well as on social engineering training and procedures.

Further, I'd prioritize cooperation with the physical security part of the organization, and HR (for personnel screening).

I'd also consider putting up a good deterrent as a cyber security policy. Both to add to the attackers risk, as well as to increase their cost.

First, by doing my job--making myself too difficult of a target in any way available to me, and letting people know about it. Stating the obvious with saying "do your job" is not too helpful, but is solid advice. It is a strong 180 degrees turn from strategies of the 1990's such as "let's not make ourselves a juicy challenge for these kids!"

Second, I'd invest anything I can spare on monitoring my network for anomalies and security incidents, starting with mapping what my network actually looks like. This might add to the risk factor for opponents that can't afford to be caught, and scare them. Covertness is the name of the game, or they would have come through the front door.

Entering am "industrial espionage defense" clause into your budget, or creating a “five year plan” to better protect your organization from organized industrial espionage, may just get you a larger budget to cope with your organization's security needs.

Do you have something you'd do different from (or in addition to) regular security practices when facing espionage from "organized" hackers? Any experience, or thoughts, you can share?

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron