<![CDATA[[SecurityRatty] tag: availability]]> http://securityratty.com/tag/availability Tue, 14 Oct 2008 20:00:00 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Confidentiality, Integrity, Availability - Pick Any Two]]> http://securityratty.com/article/c60f46f9f63d51e4a5a9e84ddb44cfe9 http://securityratty.com/article/c60f46f9f63d51e4a5a9e84ddb44cfe9 Under Worm Assault, Military Bans Disks, USB Drives


The Defense Department's geeks are spooked by a rapidly spreading worm crawling across their networks. So they've suspended the use of so-called thumb drives, CDs, flash media cards, and all other removable data storage devices from their nets, to try to keep the worm from multiplying any further.


The ban comes from the commander of U.S. Strategic Command, according to an internal Army e-mail. It applies to both the secret SIPR and unclassified NIPR nets. The suspension, which includes everything from external hard drives to "floppy disks," is supposed to take effect "immediately." Similar notices went out to the other military services.

In some organizations, the ban would be only a minor inconvenience. But the military relies heavily on such drives to store information. Bandwidth is often scarce out in the field. Networks are often considered unreliable. Takeaway storage is used constantly as a substitute.


Its almost like we built out a bunch of systems and then connected them to huge networks without building security into the software or something.
]]> Fri, 21 Nov 2008 06:50:19 +0000 networks worm assault huge networks worm flash media cards military bans disks internal army e-mail nipr nets military relies heavily Confidentiality, Integrity, Availability - Pick Any Two <![CDATA[Fortinet beefs up midrange FortiGate security appliance]]> http://securityratty.com/article/b0267ba55905c1984cadda8b6c6d41f2 http://securityratty.com/article/b0267ba55905c1984cadda8b6c6d41f2 Add to digg Add to StumbleUpon Add to Twitter Add to Slashdot
]]> Wed, 19 Nov 2008 02:00:00 +0000 threat management device fortinet replace availability businesses model Fortinet beefs up midrange FortiGate security appliance <![CDATA[Fortinet beefs up midrange FortiGate security appliance ]]> http://securityratty.com/article/b8762f4125097c257b9ea54816ae9584 http://securityratty.com/article/b8762f4125097c257b9ea54816ae9584 Tue, 18 Nov 2008 21:00:00 +0000 threat management device fortinet replace availability businesses model Fortinet beefs up midrange FortiGate security appliance <![CDATA[Credit for Researchers]]> http://securityratty.com/article/408b969da73a95cd64bb6d0b550aa038 http://securityratty.com/article/408b969da73a95cd64bb6d0b550aa038 Computer security researchers are much like scientific researchers in several ways. We build on the research of those who come before us, we sometimes rediscover the same things independently, and other times we forget where we learned things and sometimes claim them as our own. We also occasionally take an engineer’s approach and implement research discovered by others and not credit them as it’s the implementation into a tool that matters to us.

The latest Microsoft patch MS08-68 is a great example. It is a problem with NTLM authentication where the attacker can force a client to authenticate to him and the credentials, while not exposed in cleartext, can be relayed to another server or brute forced to obtain the cleartext. This is a very classic crypto protocol vulnerability. It’s not the crypto algorithms that are the problem, but the protocol implementation.

Microsoft recently fixed the problem, perhaps due to the availability of exploit code, the availability of an easy to use Metasploit implementation, or perhaps Microsoft’s changed tolerance for vulnerabilities. We can sum it up as a change in the threat space that made it worth fixing. But make no mistake, this is a very old problem.

News reports have been citing Sir Dystic’s SMBrelay tool, which was published in March, 2001, as the first knowledge of this vulnerability. Eric Shultze who worked at MSRC in 2001 just yesterday is quoted as saying, “I have been holding my breath since 2001 for this patch.” Obviously it is a long time coming. But this wasn’t the first publication of the problem. In 2000, one of my collegues on the research team at @stake, Christian Rioux (aka Dildog) published the telnet NTLM authentication vulnerability.

Rioux’s advisory has a great description of the credential relay and cracking weaknesses. I have talked to him and he says he discovered these problems independently, but he didn’t find them first. Dominique Brezinski published exactly these NTLM vulnerabilities in the SMB protocol in 1996 in a paper titled, “A Weakness in CIFS Authentication”. The earliest reference I can find on the paper on the net is here where it is included in another paper published in 1997. Such is the ad-hoc world of independent security research of 12 years ago which still continues today.

It seems ridiculous that a field like security research, which is so important to the running of modern society is so ad-hoc. Shouldn’t we know who discovered a vulnerability? Shouldn’t all researchers and engineers know about it? More importantly if someone implements a tool that takes advantage of a vulnerability shouldn’t they credit the discoverer? Don’t get me wrong. Implementation takes a lot of work and sometimes makes all the difference in makeing people aware of a security problem. After all when I was at the L0pht our slogan was, “Making the theoretical, practical”. I still think researchers should get credit when credit is due.

The security community has gotten better at documentating our research but I still see instances of independent discovery, misplaced credit, and tools giving no credit to researchers. I hate to say it but getting a bit more academic is in order. Credit is the currency of a researcher and placing it well will reward the right people and we will all benefit.

]]> Thu, 13 Nov 2008 16:40:18 +0000 security research research independent security research researchers security credit security community scientific researchers computer security researchers Credit for Researchers <![CDATA[Compromised Portfolios of Legitimate Domains for Sale]]> http://securityratty.com/article/5b1e0d15dd199fd7476dbd877e605255 http://securityratty.com/article/5b1e0d15dd199fd7476dbd877e605255 Is the demand for access to compromised legitimate portfolios of domains -- where the price is based on the pagerank and is shaped by the number of domains in question -- the main growth factor for the increasing supply of such stolen accounting data, or is it the result of cybercriminals data mining their botnets for accounting data that would provide them with access to such portfolios of high trafficked domains with clean reputation? Moreover, would such a data mining approach made easily possible due to the availability of botnet parsing services and stolen accounting data dumps streaming directly from a botnet, would in fact be the more efficient approach in injecting their malicious presence on as many hosts as possible, next to the plain simple massive SQL injection approach?

As always, it's a matter of who you're dealing with, and their understanding of the exclusiveness of a particular underground item at a given period of time. This exclusiveness is inevitably going to increase due to the fact that they're several "vendors" that are already purchasing access to such portfolios, as well as compromised Cpanel accounts as a core business, the access to which they would later on either resell at a higher price enjoying the underground market's lack of transparency, or directly monetize and break-even immediatelly. As for this particular proposition for an account with 404 domains in it, it's interesting to monitor how the seller is soliciting bids from multiple sources by leaving the price an open topic, clearly indicating his low profile into the underground ecosystem. How come? An experienced seller or buyer would be offering or requesting page rank verification respectively.

With nearly each and every aspect of cybercrime already available as a service, or literally outsourced as a process to those supposidely excelling into a particular practice, building capabilities for data mining botnets is no longer a requirement, with the people behind the botnets monetizing all the data coming from it by soliciting deals of accounting data dumps based on a particular country only.
]]> Fri, 24 Oct 2008 06:24:33 +0000 data data dumps based data dumps domains cybercriminals data portfolios based access botnets Compromised Portfolios of Legitimate Domains for Sale <![CDATA[Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more]]> http://securityratty.com/article/5ad9e83dc3458677a18e9f3f40c0fb21 http://securityratty.com/article/5ad9e83dc3458677a18e9f3f40c0fb21

Synopsis:  Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more

Welcome to Blue Box: The VoIP Security Podcast #84, a 30-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

Show Content:

NOTE: Long-time listeners will note that the show notes above are in a less descriptive form than usual. After almost three years of using one wiki for preparing for our shows, Jonathan and I switched to using a new system and are still working out some of the details that will speed the input into show notes.

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Mon, 20 Oct 2008 04:32:28 +0000 skype blue box news tools voipshield comments audio comments podcast skype messages Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more <![CDATA[Links List 10.17.08]]> http://securityratty.com/article/794a0935dd027c6a33ce5d3ef58fb2e3 http://securityratty.com/article/794a0935dd027c6a33ce5d3ef58fb2e3 Novell announced this week its intent to purchase Managed Objects. We really didn’t see this coming. Novell? Can’t quite figure out the master plan here. I mean, they said they’d acquire PlateSpin back in February which made a lot of sense for bridging the gap of physical to virtual and building out a management portfolio beyond ZENworks Orchestrator. But Managed Objects? CMDBs? In this economy? We have to think back to the survey [link to survey post] we just did at Interop NY and the low scores – on importance and actual deployments – that CMDBs got. When it comes to tightening the belt, CMDBs kinda fell off the list. We’ll be looking forward to future announcements to see how this plays out.

Martin MC Brown at ComputerWorld has a great post on capacity planning and cloud computing. He discusses a new book “The Art of Capacity Planning”. The problem with the current model of data center management is that often a large number of machines may sit relatively idle while waiting for the traffic spike that causes them to be used. This is a problem because it’s simply a waste of time and resources on a whole number of levels. Enter the cloud – or at least the “hope of cloud computing”.

Numbers – what do they really mean? IDC released a statement with a whole bunch of them from their “Worldwide Quarterly Server Virtualization Tracker”. The most interesting stat: x86 Virtualization License Market Standings. VMware owns 44% of the market, but Microsoft, in its first quarter of general availability for Microsoft Hyper-V (plus Virtual Server 2005), has 23% of the market of new shipments.

]]> Fri, 17 Oct 2008 23:26:41 +0000 post data center management cloud microsoft hyper-v cmdbs microsoft virtual server survey post virtual Links List 10.17.08 <![CDATA[Outsourcing Infrastructure Management]]> http://securityratty.com/article/ada5b9e1480c667e87cda8df368d3eae http://securityratty.com/article/ada5b9e1480c667e87cda8df368d3eae Have you experienced this? You call [fill in the blank] tech support and reach “Bob Smith” whose accent doesn’t quite match the name. If you’re like me, you wonder two things: is his name really Bob Smith? And if it’s not, why is he lying?

Is it supposed to make me feel better about getting my problem fixed if I’m talking to someone in the Midwest versus someone in Bangalore? (Please no hate mail – I’m from the Midwest.) Honestly, I just want my computer to stop showing me a blue screen of death.

But apparently, I might be in the minority. According to the Black Book of Outsourcing (yes, outsourcing has a black book), reverse outsourcing is on the rise with “India’s leading service providers opening offices on Main Street, USA” to be closer to customers (mainly North American) and draw from the “local talent pools”.

The one area of outsourcing bucking this trend – infrastructure management. Co-writer Scott Wilson says that infrastructure management is largely automated, low touch and does not involve a lot of interaction.

Speaking as a vendor of infrastructure management tools, that’s a bunch of malarkey. Perhaps at a very low level this is true (i.e., is the device responding), but that’s just the tip of the iceberg when it comes to monitoring performance, availability and SLAs for today’s networks, systems and applications.

Certainly as vendors, we try to put as much automation as possible into our toolsets – helping our customers to simplify IT management wherever possible, enabling them to be proactive by setting up “intelligent” alarms and thresholds that warn of problems before they become showstoppers and reacting at a speed in this increasingly virtual world that simply is not possible for human manual interaction.

But infrastructure management doesn’t happen in a vacuum and you can bet when something goes wrong which affects some mission-critical app state-side, that there is a LOT of communication and interaction. And it takes a lot of work and setup to get to a level of automation where the alerting is proactive and intelligent and customized for each business.

One of the main points of tools like ours is to automate where possible in order to free up the valuable time of the sysadmins, network engineers, IT managers, etc to do the higher order work – which is how they’ll get to the next level of infrastructure management. Beyond “is it up”, infrastructure management should be providing answers to questions like: “is it always up”, “is it doing what I expected it to do” and “will it still be working as expected as my company grows”.

]]> Fri, 17 Oct 2008 12:30:15 +0000 management infrastructure management trend infrastructure management infrastructure management tools human manual interaction bob smith reach bob smith interaction tools Outsourcing Infrastructure Management <![CDATA[6 Months And Counting For Microsoft On CVE-2008-1436]]> http://securityratty.com/article/630af6ad6042b9974b3ce04fba8e2039 http://securityratty.com/article/630af6ad6042b9974b3ce04fba8e2039 a rather serious security advisory: Vulnerability in Windows Could Allow Elevation of Privilege (951306). Microsoft never provides gory details to vulnerabilities even after they've been patched, but by following the CVE entry from it you can get links to sites like IBM's ISS which are willing to say more, or even to get proof-of-concept exploit code from SecurityFocus. The vulnerability allows authenticated attackers potentially to elevate privileges to LocalSystem. Here we are, 6 months later, and Microsoft still has not patched this vulnerability. What's up with that? "Dustin" from the Microsoft Security Response Center recently addressed the question in a blog on Technet, following an update to the advisory to note the availability of the proof-of-concept code. It's worth noting that this vulnerability isn't really near the top of the scare list. Most of those 3rd parties you see linked on the CVE page rank it down a few notches. Even the usually hyperbolic Secunia calls it "Less Critical" (2 out of 5, 1 step up from "Not Critical"). Furthermore, back in April Microsoft provided workarounds which it says are effective against the proof-of-concept, at the cost of some administrative burden. They also say that they are unaware of any real-world attacks on this vector. You can find more details from Microsoft on the bug in Nazim's IIS Security Blog and the Security Vulnerability Research & Defense blog. Still, 6 months! What Dustin said was "...we began our investigation and immediately realized it would not be trivial to address this issue without introducing new risks." They're still testing and developing a fix. 6 months later. It would seem that the obvious fixes all cause some serious problem, perhaps breaking 3rd party code. Is this inherently unreasonable? It's getting there. The list of affected software includes most of the important versions of Windows. It may be that some of the time this has taken has gone to working with my speculative 3rd parties to update their own software, so that the fix won't have the same impact. But let's not forget that this is not an easily exploitable bug. It's not wormable in any way and by the time it's invoked other serious breaches of security have to have happened. So I guess it's worth it for Microsoft to take their time doing it right.

]]> Thu, 16 Oct 2008 11:24:58 +0000 microsoft defense blog blog iis security blog security security vulnerability research april microsoft april vulnerability 6 Months And Counting For Microsoft On CVE-2008-1436 <![CDATA[Building an enterprise security program in 10 steps]]> http://securityratty.com/article/e3916741b83912cd023dc82a3b855e61 http://securityratty.com/article/e3916741b83912cd023dc82a3b855e61 Tue, 14 Oct 2008 20:00:00 +0000 information business information exists information security tenets information moves multiple applications political boundaries security threats system vulnerabilities complex ecosystem Building an enterprise security program in 10 steps