Malicious PDF documents on the rise...

There are some nasty malicious PDF files (read more…) going around the Internet for which most Anti-Virus tools provide little or no detection. As a good security precaution, if you use or read PDF files, you should take the following two actions:



1. Make sure you are using the latest version of Adobe Reader (formerly known as Adobe Acrobat Reader), which as of this writing is 9.2.0 (Open Adobe Reader and choose Help->About… to see what version you have installed, and then Help->Check for Updates to get the latest version.)
















2. Open Adobe Reader and disable JavaScript by choosing Edit->Preferences->JavaScript and the uncheck the checkbox next to “Enable Acrobat JavaScript” as shown below.


















Wishing you a safe computing year in 2010,

-boni bruno

Physical Access Control - The New Way

Historically, physical access controls have never run over IP networks, but now with Cisco in the game, the convergence for a complete physical access control solution over IP networks is now a reality.


The Cisco Physical Access Control solution is made up of both hardware and software components. The Cisco Access Gateway connects door hardware (traditional readers and locks,as well as the new Hi-O® hardware from Assa Abloy) to an IP network. In wired deployments, the device is capable of being powered by Power over Ethernet (PoE). It is also possible to connect to the gateway over a Wi-Fi 802.11a/b/g wireless link.

The diagram below depicts a typical Cisco PAC archtiecture:



Since there is a gateway for each door, access control can be deployed incrementally, door by door. There is no central panel; this simplifies system design, wiring, and planning, resulting in significant cost savings over legacy architectures. Additional modules can be connected to the gateway, allowing for extensibility. All communication from and to the gateways is encrypted.
The Cisco Physical Access Control solution offers the following modules (in addition to the Access Gateway):

* Reader module: This module can connect to a complete set of door hardware, allowing an additional door to be controlled by the same gateway.

* Input module: Eight supervised inputs can be connected to this module and controlled
through the gateway.

* Output module: Eight outputs can be connected to this module and controlled through the gateway.

Cisco Physical Security Manager (CPSM) is the software application used to manage the Cisco Access Gateways on the network. The Web-based software provisions, monitors, and controls all the access control gateways on the network. Role-based access control policies are supported for CPSM. You can create access control policies for N-person, two-door, anti-passback, etc.

CPSM also integrates with MS Active Directory, LDAP, and some HR databases.


CPSM is integrated with the Cisco Video Surveillance family of products, enabling an organization to associate cameras with doors, and to view video associated with access control events and alarms.


In addition to basic access control features, Cisco plans to integrate physical access control with network security to provide a comprehensive solution that spans both areas of security, allowing enterprises to:


* Create and enforce policies so that network and application access is granted based on the physical location of employees

* Provide wireless access only if employees have badged into a physical location.

* Terminate an employee’s active VPN connection when that employee badges into a physical location

* Change an employee’s privileges on the network based on entering or exiting a secure area

There is no question that Cisco is accelerating convergence in the physical security industry. The move to integrate physical access control and network security is something I've been preaching for a while now, it will be interesting to see how this evolves over time. I'll keep you posted...


Stay secure,


-boni bruno

DRM Free Music - Wow what a concept!!!

Have you heard the news??? Apple has convinced the big music studios to let them distribute DRM Free music.

http://www.nytimes.com/2009/01/07/technology/companies/07apple.html?_r=1&hp

It's about time and something the music industry should have considered long ago.

The issue now is that Apple is the only organization with the license to do this. This gives Apple too much leverage in my opinion. We need more legitimate distribution channels and keep things competitive for the benefit of consumers, but this is definitely a move in the right direction...

Well done!

- boni bruno

What Industry Executives need to know about DRM...

DRM stands for Digital Rights Management. It has also become known as Digital Restrictions Management as a backlash from all the problems and issues DRM has caused hardware manufacturers, software development companies, media distributors and consumers over the years. Consumers want on demand music, video, movies anywhere at anytime and they are willing to pay for it. I've done enough research and field tests to make this claim. This is also true for media distributors and retailers who have been yearning for the ability to manufacture media on demand to consumers. However, many current DRM policies and technologies do not facilitate this kind of media access and distribution. Until we foster and promote better DRM strategies, money will continue to be lost to the pirates...

I meet with industry executives all the time and content protection and the secure distribution of content is a very big deal. DRM is important to the Entertainment, Music and Media industries, i.e. the content producers, in that these industries want to safe guard their intellectual property and copyright protected material from piracy so their financial interests can be protected. Make sense to me.

With respect to piracy, the music industry has been hit the hardest with significant drops in sales year over year. It's still very common to see people share music files over peer-to-peer networks and not think twice about having to pay a single cent. Also, boot leg copies of the latest movies are readily available on the net or DVD just about anywhere you go. Bottom line, piracy continues to run rampant and it's an issue that needs to be better addressed moving forward.

The goal behind DRM is to ensure that copyright protected media is accessible to only the consumers that pay for it. Many of the negative connotations associated with DRM are derived from the poor designs employed by many content protection schemes as well as from the notorious Digital Millennium Copyright Act passed in the U.S. in 1998. I'll talk more about DRM technologies later, but DMCA is the entertainment and media industries strategy to make it illegal for anyone to develop and use products that circumvent DRM related technologies. This is huge and has both good and bad implications. The spirit behind the DMCA law makes sense, but the law itself as written, interpreted and legally practiced has short comings. DMCA allows content producers to license and dictate how hardware manufacturers and software development companies enforce DRM technologies in their media related products. In short, media hardware manufacturers and software companies have to support and integrate licensed DRM technologies to comply with the mandates of DMCA.

As a result, there have been a slew of licensed DRM technologies integrated and deployed by various hardware manufacturers over the years from analog protection systems, Marcovision and Dwight Cavendish, to content protection systems like CSS, DTCP, HDCP, TIVOGUARD, etc. DCMA also influence software companies to embed DRM technologies into their products, e.g. Microsoft's Windows Media DRM and Real Network's Helix DRM. There has been extensive criticism that DMCA forces all companies that make media related equipment or software to support DRM technologies that financially benefit specific organizations only and no one else which potentially inhibit innovation and good old fashion competition. DMCA also makes litigation by media companies very easy regardless of whether a direct copy right violation has occurred. This has caused many respected scientific research and security related web portals to just shut down and has provoked many heated arguments about justice and the right to compete.

As technological advancements are made with High Definition TV, IPTV, Broadband, WiFi, and Mobile technologies, new emerging DRM systems are being developed to keep up - Advance Access Content System, Broadcast Flag, MagicGate, Open Mobile Alliance, SmartRight, Video Content Protection System are emerging DRM technologies that will be licensed in many products to come.

The big question I want you to think about is whether or not we are headed down the right path. Does DRM practices have to be so nasty? A well known example is Sony's decision to integrate a rootkit to copy protect their music CD's. This turned into a huge PR nightmare and caused Sony to recall the music cd's and rethink it's whole DRM strategy and left many consumers in a outrage! There are many cases where web sites were shutdown due to DMCA violations, it’s a good thing the safe harbor provisions were put into DCMA or many ISP would be out of business and half the internet would be gone.

I offer that there is a better solution. I believe the right DRM strategy is to make things simple and easily accessible to the consumers and media distributors. I believe consumers in general are good people and will pay for copy protected media if it’s readily available, globally reachable, and fast. This is not to say we throw security technologies out the door (God knows that would impact me financially), but rather make it clear to the industry that DRM strategies needs to evolve and focus less on restricting the rights of consumers and more to promote the availability and access channels that allow consumers to pay for copy protected material.

I'm a big fan of global media distribution networks and the download-and-burn concept. The sooner we go to market with IPTV, HDTV, High Speed Broadband & Mobile Communications, easily accessible and feature rich set top boxes and media devices, and employ the use of multiple broadcast and distribution channels and just flood consumers and media distributors with every imaginable means to buy licensed content - guess what?

THEY WILL!!!

Performance Anomalies Can Be A Sign of Bigger Problems...

I have a great story to tell you...I get a call from one of my clients,
they are a big real estate management and development company
with many large Oracle databases and various Unix and Microsoft
systems, a large SAN, and they run the network on the high-end
Cisco stuff. Typical architecture for a large enterprise.

These guys have a lot of vendor consultants on site helping them out
with new Oracle Apps, Unix systems, etc. The problem, I'm told by one
of their Senior Vice Presidents, is intermittent performance problems that affect the network and the Oracle Apps.

Hmmm...probing him further for more details did not give me much. He did explain to me that none of their Oracle or Unix consultants saw any problems with anything, the system administrators didn't see any problems on the systems, but the network guys were seeing intermittent network utilization problems coming from the application servers - basically they're monitoring the network with SNMP and every now and then they get alarms stating high utilization of the network. They give this info to the consultants yet they find no problems.

Their VP asks me to do my own performance assessment and I did. I arrive on site and begin speaking with the network team. They basically tell me that two particular application servers intermittently consume a large amount of bandwidth. This has been going on and off now for many months and no one knows why.

So, I take a look at these two application servers. They happen to be Solaris Unix systems. I ran some netstat commands and saw that there were some input/output errors on these systems. I then proceeded to run some process status commands, I use both the ATT and UCB versions of ps when I want to get various process info. The weird thing here is that the UCB version of ps listed some additional processes that the ATT version didn't show - this is not normal. The process tree should be the same. So I download lsof (a powerful Unix utility that didn't ship on many earlier Solaris distributions), and I found some hidden processes that the running ps commands didn't show. Hmmm. This is looking bad. I trace the processes to some hidden files and found that the system was hacked. Not only was the system hacked, it was hacked by two different groups and over a year ago!

The first hackers installed what is known as a root kit. The root kit basically installs hacked versions of many system utility programs to keep system administrators in the dark about the running hacker programs. Basically my clients systems were used as bots to run denial of service attacks against other nodes on the internet. During these attacks, the bandwidth would be consumed and the performance problems would occur. When the system administrators and consultants looked at the problem using the system utilities, they did not see the actual running programs as the root kit hid it from them.

Looking at the security of the system, they were originally breached through an Apache vulnerability. When I suggested they upgrade to a more secure version of Apache, their development team stated that would violate their Oracle support agreement! OMG!!!

Anyway, another group of hackers were also using the systems based on the time stamps I saw on their programs. These guys used a cool tool called stunnel (it was renamed and hidden in this case) which allowed them remote access into there system via IRC servers. I found the embedded irc servers and cryptic login information being used by stunnel. I was curious and logged into the irc server with the login details I uncovered and low and behold, the hacker was online and boy did I catch him off guard. I had enough info on the hacker and gave a lot of forensic data to my FBI contacts and the hacker ended up being prosecuted and convicted and had to pay restitution to my client. Nice ending to a twisted scene.

So the next time you hear you may be having a recurring performance problem, take a deeper look into the situation, you may be surprised what you find out... ;)

-boni bruno

Using Broadcast Data as an Attack Vector...

It's amazing how much information you can gather from computers via the data they openly broadcast on the network. This article discusses how such information can be used as an attack vector to compromise data security and other informational assets.

First, let me begin with a true story that I was personally involved with. I was working on a new project as a network architect for a large organization that has 18B in assets and listed on the NYSE. This particular organization had a working area for consultants to use, and since I was on-site for several months, I was privy to the other projects and the other consulting companies also working for said organization. As you would expect, SOX compliance is a big deal for organizations that have their stocks traded on the NYSE, and yep, they had one of the big four accounting firms on-site with a audit team that grew to 12 auditors, 2 project managers, and 1 supervisor handling a SOX audit while I was there.

To make a long story short, the consulting area could not accommodate all the consultants so certain liberties were taken. This team of auditors had the audacity to set up their own wireless access point (open - no encryption) without telling the client. They used this AP to extend access to the team so everyone could access my client's network as well as share resources among themselves. I told upper management about this, but to my dismay, no immediate action was taken, apparently the team convinced them it was a necessity and the AP remained on the network - WOW!

Day in day out, the team would come in the morning, turn on their laptops, and proceed with their daily routines. I use various network tools to conduct my work, while using my tools I began to observe various broadcast data coming from the audit team laptops in the consulting area.

First, I saw ARP/DHCP broadcasts which exposed MAC addresses, previously used IP leases, routing information, etc. (There is a handy tool for you Unix/Linux enthusiasts called Passifist available at http://www.cqure.net ) that clearly shows how much one can gather from broadcast traffic.


Anyway, in the mornings, when the audit team came in and booted their laptops, I was able to see the DHCP request of their previous IP addresses - interestingly enough, many of these addresses came from the DHCP servers located in their corporate office. I know this by the IP addresses and NETBIOS information. In this case, some of the team members were last connected to the network back in their corporate office and I was able to learn various IP specifications just by observing their broadcast traffic. Hence, not only did they expose my clients network by installing that damn wireless AP, but the broadcast data clearly exposed information about their corporate network as well. (Mental note here - Broadcast data can tell you about multiple environments you have been connected to.)

Furthermore, NETBIOS/SMB broadcasts disclosed the teams NETBIOS names, login IDs, and various server information they typically used back in there own office. Many people I know consider broadcast traffic as harmless bits and bytes that are just part of normal day to day network communications - you should now be aware that there is more to it than that!

You should also be aware that Startup Applications can also cause additional broadcast information to be sent out on the network. Some of the team members had IM accounts that were broadcasted. I saw VPN related broadcasts, iTunes broadcasts and even virus software broadcast data for signature updates. There is definitely more to broadcast data than many people understand, and this so called audit team was just clueless...


When I turned on my wireless sniffer, I was able to see even more information. I saw all the wireless access points that were cached in the audit teams laptops being broadcasted, including the one the team put up in the consulting area. I couldn't help but imagine computer hackers sitting in airports, hotels, internet cafes collecting this kind of broadcast data.


There are a slew of tools available on the net that can easily take advantage of such broadcast information to the point that traffic can be diverted to spying machines with little effort. If you get the chance, try playing with a little tool called DSNIFF available at http://monkey.org/~dugsong/dsniff/. This tool allows you to redirect traffic to your machine so you can easily inspect data.


Another interesting tool that specifically takes advantage of broadcast data is a tool called Karma available at http://www.theta44.org/karma/index.html. With this tool you can impersonate a wireless AP, DHCP/DNS servers, email and chat servers, etc.


With tools like these available on the net, it should be very clear that broadcast data can be used as an attack vector for hackers, and with the slew of exploits available with Metasploit - see http://framework.metasploit.com/msf/, you simply need to protect yourself and enforce good security practices!


Anyway, getting back to the story, my immediate concern was to shutdown the AP since any nearby resident could hop on the network and see what was going on. Running packet captures gave me visibility into a lot of the data that was being accessed by the audit team. I ran a wireless site survey showing the range of this rogue AP (yeah, it extended to the public streets) and hit management over the head with all of the information I obtained. They finally took down the AP, but only after I had install a new switch with more ports for these clowns in the consulting area! ;)


It still amazes me how many risks you have to manage on a day to day basis and how little senior managers know and understand information security. I hope you enjoyed this article and that your information security awareness has increased as a result of reading this and the associated web links provided.

Stay well and stay secure...

-boni bruno