It would be funny if it weren’t so damn plausible.

Diebold Accidentally Leaks Results Of 2008 Election Early

If you have been living in a cave for the past few months you may not be aware of Comcasts recent practice of “shaping” bit-torrent traffic.

Specifically they insert RST packets into, what they believe to be, bit-torrent sessions and forge them to look like they came from the host at the other end of the session. For those of you not familiar with hot TCP/IP works, a RST packet is normally sent to tear down an established session. If this is erroneously sent in the course of a communication (as is the case with Comcast) your computer will get confused, drop and have to re-establish a connection.

The primary issues with this are…

1. In order to associate the RST packet with your bit-torrent session they have to forge it to make it appear as if its from the other host you are communicating with. This violates a number of U.S. computer crime laws.
2. They do a pretty crappy job in determining what bit-torrent traffic is. A number of reports have surfaced indicating the Lotus Notes and a number of other protocols are being improperly “shaped” as a result of this.
3. A large number of legitimate software packages are distributed ONLY via bit-torrent. This is often the case with open source and free software as the developers are usually unable to afford the bandwidth required to distribute their works.
4. I have yet to receive an sort of “Terms of Use” update informing me that this traffic is being mangled.

Another things that irks me regarding Comcast’s media handling of this is a position often stated by their PR and Executives.

Cohen also reiterated Comcast’s position that it doesn’t block traffic. “Comcast does not, has not, and will not block any websites or online applications, including peer-to-peer services,” he said, pledging to work with the FCC to “bring more transparency for consumers regarding broadband network management.”

They don’t seem to understand that inserting a RST packet is “blocking” traffic. A number of hardware Intrusion Protection Systems use that method to block intrusion attempts when they are not configured “inline” and have the ability to kill a session normally.

The folks at consumerist (excellent site, btw) just posted a copy of the disclosure letter geeks.com (aka computergeeks.com) sent to customers informing them that their credit card data may be compromised.

A few items that concerned me about the disclosure are…

Genica Corporation dba Geeks.com
1890 Ord Way Oceanside, CA 92056
January 4, 2008

[snip]

The purpose of this letter is to notify you that Genica dba Geeks.com (”Genica”) recently discovered on December 5, 2007 that customer information, including Visa credit card information, may have been compromised. In particular, it is possible that an unauthorized person may be in possession of your name, address, telephone number, email address, credit card number, expiration date, and card verification number.

Two things immediately jump out at me in this first chunk of text. The first is date of letter compared to the stated date of discovery.

Being a PCI-DSS guy I know that most merchant gateway providers require disclosure within 1 day of “a suspected compromise”. Granted, that is disclosure to the merchant gateway and not customers. However, computer geeks operates out of California which is on the forefront of disclosure laws. In fact the California Security Breach Information Act (SB-1386) states…

Any agency that maintains computerized data that includes
personal information that the agency does not own shall notify the
owner or licensee of the information of any breach of the security of
the data immediately following discovery

The other troubling part was “and card verification number”. This is the CVV2 that is NEVER to be stored per PCI directive 3.2.2.

3.2.2 Do not store the card-validation code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions

I am troubled by the fact that vendors still remain clueless on best practices and regulations that govern their actions. I am even more disturbed with the fact that (despite these regulations) implementing proper safeguards and demonstrating caution is in their customers best interests, but yet is still not done.

I recently posted a comment on FOSSwire.com in response to other comments condeming the author for suggesting moving ssh to a port besides 22 was “security through obscurity” and a worthless security measure.

I have argued this topic many times with many different people and felt that comment bears repeating for my downgrade.org audience.

– snip –

Gah! I have heard that argument over and over again about changing ssh to a non-standard port.

“security through obscurity is no security at all” Says the broken record.

I believe heavily in security metrics because numbers are awfully hard to argue with.

In a university environment a machine with ssh on port 22 in my DMZ would receive an average of ~100 invalid login attempts per day (averaged over the course of 2 months).

This same machine in the same DMZ running SSH on port 51234 received an average of zero… no, not a average of zero… just zero.

This effectively eliminates all scripted attacks, worms, Trojans, bots and most uninitiated real attackers.

In fact if you run it on a very high port — say 51234 — most people won’t even find it with a port scanner.

One would have to statically define the port range as most port scanners quit far before 51234.

At that rate scanning ports 1-51234 would take an insane amount of time per host, and most attackers scan huge blocks of hosts.

At that point hopefully an IDS/IPS would pick up the port scan and make the whole thing moot.

Seriously. Its not a fool proof security measure and I certainly wouldn’t use it as the only means of protecting SSH, but its an effective layer. And those same people that are so quick to spew out the “Security through obscurity” cliche are also the same that are quick to pull out the “Layered Security” ones.

– snip –

Best of 2007

• Gizmodo’s Most Popular Hits of 2007
• LifeHacker.com - The Best of 2007 Roundup
• Break.com - Top 10 Internet Videos of 2007
• arstechnica.com - 2007: The year in review
• Search Security - Top 10 Security Headlines of 2007

Tech

• IANA and ICAN rolling out IPV6 on Root Name Servers

Security

• Business Week - Homeland Insecurity

Privacy

• U.S. is “Endemic Surveillance Society” Says Electronic Privacy Information Center and Privacy International
• Eavesdropping on Bluetooth headsets

Apple

• Appletel - Ultimate Leopard Tweaking Guide

You can use NSM (Netscreen Security Manager) to manager your Netscreen firewalls.

You can use OpenNMS to monitor your servers.

You can use NSM (Network Security Monitoring) to monitor your network.

From now on you’re Bob, you’re Fred and you’re Julio… I hope you all can play nice together.

I have been working on various SIEM (Security Information and Event Management) and log retention policy related projects lately. Through these projects, and others that I did as a security consultant, I have developed a list of log categories (or log types).

Surprisingly, I have found little to no authoritative document that provides such a list.

I have read through various RFCs, The NIST SP 800-52 Guide to Computer Security Log Management and a large number of other documents. And still not found a comparable list.

Because of the lack of existing lists I wanted to post what I have come up with in hopes that it will help others seeking out the same information, or at least generate conversation and point out other resources or types that I may have missed.

1. Audit Trails: logs that document application or OS changes made and/or specific actions taken by a user. Also includes “object access/change” logs… This would include output from change management systems and system integrity logs like tripwire produces
2. Event Logs: internal system or application events that are not specific to a user or user generated
3. Traffic/Access Logs: web server hit logs, contain url accessed, visitor ip, browser, ect.
4. Filter device Logs: allow/denies from: firewall, ips, acl enforcing routers, ect.
5. Exception Logs: error logs
6. Network Traces: packet captures, flow data, ect.
7. Authentication Logs: login/log out/invalid logins and session tracking
8. Physical Access Logs: visitor log, biometric/badge/token door logs
9. Transaction Logs: database generated
10. Data Logger: statistical or numeric data. Data center environmental monitors, web hit counters, manufacturing equipment output data, ect.

Obviously some systems would lump data from multiple categories into one physical file. This is where a good parser or SIEM product would come into play.

These categories also only include log data that would generally be ‘computer generated’ and are to be considered top level categories. Many different sub categories may exist under each.

“Around 1,800 of the portable Maxtor hard discs, produced in Thailand, carried two Trojan horse viruses: autorun.inf and ghost.pif, the bureau under the Ministry of Justice said.”

“The affected hard discs are Maxtor Basics 500G discs.”

“The bureau said that hard discs with such a large capacity are usually used by government agencies to store databases and other information.”

“Sensitive information may have already been intercepted by Beijing through the two Web sites, the bureau said.”

source: http://www.taipeitimes.com/News/taiwan/archives/2007/11/11/2003387202

This sounds rather sensational, eh? I certainly hope it is.

Lets start with the “carried two Trojan horse viruses” part. This is a common mistake made by writers who don’t know anything about technology or information security. The word “viruses” is incorrect. To qualify as a virus the malicious software would require a propagation mechanism. As best I can tell from the articles, this is just a run of the mill trojan.

Next we see that they believe a hard drive shipped to a defense contractor or government agency wouldn’t be formated before being put into production. I will admit that from time to time large organizations may seem inept (none of us are as dumb as all of us) but policy and procedure should be in place to prevent things like this.

The same hysteria came about in May of 06 with Lenovo at which time I made the same argument. The only difference in this case is that this is an actual threat instead of a perceived threat.

In the article it also says…

“The tainted portable hard disc uploads any information saved on the computer automatically and without the owner’s knowledge to www.nice8.org and www.we168.org, the bureau said.”

So following this trail starting with nice8.org we come up with;

Domain ID:D145807509-LROR
Domain Name:NICE8.ORG
Created On:11-May-2007 07:20:24 UTC
Last Updated On:27-Sep-2007 05:57:07 UTC
Expiration Date:11-May-2008 07:20:24 UTC
Sponsoring Registrar:Xin Net Technology Corporation (R118-LROR)
Status:OK
Registrant ID:JHV8DUH7W9TIL
Registrant Name:ga ga
Registrant Organization:gaga
Registrant Street1:gagaga
Registrant Street2:
Registrant Street3:
Registrant City:gaga
Registrant State/Province:Beijing
Registrant Postal Code:126631
Registrant Country:CN
Registrant Phone:+86.2164729393
Registrant Phone Ext.:
Registrant FAX:+86.2164660456
Registrant FAX Ext.:
Registrant Email:safsafsa@ca.ca

Apparently we are dealing an evil mastermind named “Ga ga” who lives on “gagaga street”.  I have heard grumblings of this mad man in the hacker underground.  Okay, so its made up… probably random keyboard bashing.  Dead end.  You get similar worthles results when whois’ing we168.0rg.  Both of which are down now.

There are reports of an in-the-wild Trojan horse program that targets
Mac OS X systems.  Users are encouraged to visit malware-serving sites
through spam messages in Mac forums.  The Trojan, which pretends to be
a QuickTime plug-in, can hijack users’ search results, sending them to
websites the attackers want them to visit.

http://isc.sans.org/diary.html?storyid=3595
http://www.scmagazineus.com/Trojan-targets-Mac-users/article/58290/

This is yet another example of malware exploiting stupidity and thats all.  I am sick of people jumping at every trivial little article they find regarding mac malware and saying “see, the mac isn’t safe either”.

First off, nothing is ’safe’… just safer.  Second, you can have the most secure operating system in the world but if someone is stupid enough to install malicious software onto it then it will be infected just like windows.

When I see a self-propagating  worm that exploits a zero-day vulnerability in OS X, only then will I change my rant… but only slightly.

As it turns out, the secret and forced windows update is causing problems.  I have heard of this issue cropping up on non-restored systems too.

Yet another reason why I am a Linux/Mac guy.