Hack The Planet

In a recent Network World article author Dave Keams postulated that in the connected world we live in that anonymity is viewed as odd and even suspicious. He uses an example of a girl who is trying to look up information on a possible suitor and can’t find anything. She views his lack of an online presence as a possible reason to not see him, even though in the physical world he seems quite the catch.

I find this very funny on two fronts. In our new, fully connected world we have lost our ability to connect without the use of technology. The second is that good internet habits are looked at as a negative because having your private life not splashed all over the digital tabloids that are Facebook, MySpace and other sites is not acceptable.

It reminds me of Orwell’s 1984 and some of the commentary that has come from it. Basically if you have nothing to hide then why aren’t you allowing strangers to view your every move. How the government has instituted draconian laws allowing them to listen in on all our citizens phone calls and read all of their email because again, why worry if you have nothing to hide.

It is a brave, new world but not necessarily a better one.

A bill abolishing the National Identity Scheme is expected to be passed into law on December 21st after receiving royal assent. Home office minister Damien Green wrote “Photographs, fingerprints and personal information that were submitted as part of the application process for an ID card will be destroyed within two months.”

It is nice to see a country moving to return some sanity and civil liberties to it’s citizens instead of continuing to turn into a police state.

There is an interview with Marissa Mayer, a VP at Google, where the question was asked, “What have been Google’s biggest mistakes?” She answered that Wave, shutting down Dejanews and launching Gmail on April 1st (April Fools day) were the top three. I don’t want to focus on these though (shutting down Wave breaks my heart because it was great). I want to focus on what Google does really well. It learns from it’s mistakes and moves on quickly.

In my career I have worked at many start-ups and some of them have been acquired by large companies which retained me after the take over. When those companies took over you could actually feel the innovation and momentum just slow to a crawl. In a start-up you have to be fast, willing to change direction quickly and follow your instincts. If you don’t you fail. In larger organizations though it seems like it is frowned upon to challenge the status quo, to innovate or to create.

What Google does is different though (I don’t work there, never have and don’t know any one who does or has so this is an outside assumption). They build and test new ideas and if they fail to meet their standards they move on. But what they give you is some amazing functionality and great new ideas. Gmail, Google Earth, Wave (even though they are canceling it), Street View and Android. Any of these could have been done by another company but Google actually did them. They stepped up and tried it. Some of their ideas have failed, and some have cost them millions and millions of dollars but they continue to look for new ways to innovate and grow their business.

They aren’t afraid to fail and they even encourage it. Not that they want to fail or want their projects to fail but they actively learn from them and keep going out on a limb with new products and features. You can’t succeed if you don’t fail.

As Thomas Edison said “I have not failed. I’ve just found 10,000 ways that won’t work.” Don’t be afraid to fail. Be afraid of doing nothing.

There are tons of posts on the new FireFox plugin, Firesheep. Firesheep is a plugin that allows you to hijack other user’s social network sessions that are using the same wired or wireless network as you are. Eric Butler, one of the co-authors, has a post explaining how Firesheep works.

The basics of the attack are that websites like Facebook use something called “cookies” to authenticate a user that has already logged in so that the site does not have to ask the user to login again until the cookie expires. The issue is that while the sites often encrypt the initial login they don’t often encrypt any additional network traffic which allows an attacker to capture the cookie and allows them to gain access to victim’s account.

To protect yourself from this type of attack you should always maintain an encrypted session with any of your social network sites. Some folks say not to connect to these sites at all on public WiFi but in general you are better off treating every network as untrusted or hostile and just encrypt your network traffic. You can use the Force-TLS or HTTPS-Everywhere plugins, though they may not work on every site.

The slides for Firesheep from Toorcon are here.

A Firefox 0-day vulnerability is being used to vend malware from the official website for the Nobel Peace Prize. Norman ASA detection executive Einar Oftedal stated in an instant message to the Register, “This iframe has a multi exploit backend and serves exploits for Firefox, including a working remote exploit for firefox 3.6.11, we didn’t see any 0day for IE.” The malware does not target Windows Vista, or 7 systems, limiting the attack to only Windows XP users running Firefox 3.6.11 or earlier.

Mozilla is aware of the vulnerability and is working on a fix that will most likely be out later this week once it has been tested. This attack is most likely not limited to the Nobel Peace Prize website and users of Mozilla’s Firefox can protect themselves from this attack by using NoScript or disabling JavaScript in their browser.

Some theorize the attack is related to the Nobel Peace Prize being awared to Liu Xiaobo this year, who is incarcerated in China for his participation in Chapter 08.

Dutch authorities in conjunction with network security organizations have taken control of and started dismantling 143 command and control servers used by the Bredolab botnet. The Bredolab botnet had infected an estimated 30 million computers during its time and was reportedly used in a phishing scam last year against Facebook users.

A 27 year old suspect was arrested a little while later after trying to regain control of the botnet and then trying use it to DDOS the web hosting firm Leaseweb that was being used by the hacker.

While the majority of the CnC servers have been taken offline there are still some alive and kicking.

One of the more interesting pieces to me is that the Fox-IT team who is working with the Dutch authorities, are contacting the infected machines users when they log on of the infection and how to remedy it. At the posting of this over 100,000 users have been notified.

On an iPhone 4 running iOS 4.1 if you tap the “Emergency Call” button, then enter three pound signs, hit the green call button and immediately press the Lock button you gain access to the Phone app.

Well, what’s so bad about this? The Phone app includes your contacts, your voice mail and call history. Some people probably don’t think this is a large issue and it may not be. But with iPhones becoming more prevalent in the business world your contacts can include a lot of people you may not want someone else seeing. Especially in Sales where your contacts are your livelihood.

So if you have an iPhone 4 with iOS 4.1 you may not want to leave it laying around, not that you would in the first place.

According to the Kroll Annual Global Fraud Report this is the first time that cyber theft has surprassed physical theft. I am surprised that it took this long for it to happen.

The report doesn’t say that other forms of fraud are decreasing, but that the theft of intellectual property is just increasing, with 27.3% of companies reporting it compared to 18% in 2009. In comparison only 27.2% of companies reported theft of physical property. It does make me wonder what the true numbers are compared to the reported.

What it comes down to is that it is much easier to steal your intellectual property from the thief’s couch (or office chair) than it is to break into your office and take your laptops or paper clips. Saying that, the report shows that most fraud is done by insiders, people that are already part of your organization.

When companies are losing so much annually to insiders it makes me wonder what type of privileges their organizations utilize. Do they use “least privilege”, or is everyone walking around with admin rights? If your employees have access to data that they shouldn’t because you haven’t instituted a good rights management system then you really need to update your resume because your data is probably already gone.

Writing is something that I have always enjoyed. Whether it was books as a child or a journal as I grew up, I have always found peace in it. Writing a blog made sense to me but I don’t believe I have kept up my end of the bargain.

Through irregular posts and linking to stories that I have found interesting without adding much value to the conversation I have made this blog boring and empty. I am going to try and change that though.

While I will still be commenting on stories that I find interesting, specifically related to Information Security, privacy and maybe a splash of comic books or legos to boot, I am going to try and add value to the conversation.

Well, here it goes….

Why is Information Security so important to me? Why do I find it so exciting that not only have I made it my career but also my hobby outside of office hours?

I believe the answer is in my general love for all things competitive. When I was a child I wasn’t a very competitive person. I enjoyed playing games but was not really into sports. This changed in my teen years and I developed a love of games and competition. Whether it was who could clean a table fastest among my bus boy coworkers or who could run the fastest or throw the farthest among my other friends it was all a game and I loved it.

I feel that Information Security is like this. It is a game that we are playing all of the time against outsiders, insiders and ourselves. We have to protect our networks and data from elite hackers to receptionists who love Facebook and Twilight. You don’t get to stop playing this game when you go home and you have to make sure you are always learning how to play the game better, faster and know more than you did the day before. Your opponents don’t take days off and neither can you (figuratively).

There is also so much to learn. I have a thirst for knowledge and Information Security is an ever changing cornucopia of it. There is never a lack of new things to learn or research, and things to do to make yourself and your network more secure. From day to day the landscape changes and you have to be on top of your game or you will lose.

These are some of the reasons why I love Information Security. Why do you love it?

I am going to take a break from my normal topics to discuss one that is a passionate one for most people in America. Immigration.

My family is a bunch of immigrants. Not first generation but in the last few. My ancestors came to America because it was the land of opportunity. Pretty much everyone who lives in America does so because their ancestors immigrated here. I am pretty sure all of them came here for the opportunities also.

America is a great country to live in and we should embrace that. People want to come here and build their lives and families. We need to make immigrating to America better so that we can bring in the best and brightest minds from around the world and have them want to live here.

When it comes down to it, who wants to live in a country that no one wants to immigrate to?

A great article on why immigration is a necessary part of American dominance and culture is here.