Grossman's Unanswered Questions

Jeremiah Grossman, one of my favorite web application security bloggers, recently posed a few of his unanswered questions - here's my take on a few of them, but be sure to read the comments thread. Anton Chuvakin's note that "firewall + website = web application firewall" in the minds of some rings true after my own experiences with compliance efforts.

1. Do people trust QSAs who consider PCI-DSS 6.6 met if their organization only uses a network vulnerability scanner with a few web application security checks?

For those not in the know, a QSA is a "Qualified Security Assessor" - a PCI approved assessor. PCI-DSS 6.6 (updated detail) says that you can use any of the following:

1. Manual review of application source code
2. Proper use of automated application source code analyzer (scanning) tools
3. Manual web application security vulnerability assessment
4. Proper use of automated web application security vulnerability assessment (scanning) tools

The problem that Grossman points to here is that some vendors will use a vulnerability scanner that doesn't provide deep software analysis capabilities - using Nessus instead of WebInspect, for example. My answer here is a firm "No". The capabilities found in full featured application vulnerability scanning tools are far more advanced than those found in most standard host vulnerability scanners. Vendors like Qualys are expanding their capabilities here, and other vendors are or have already. My answer will likely change as these features become increasingly more capable, but for now unless the QSA explicitly explains it, this doesn't appear to be the right solution.

Does this mean that organizations without internal technical expertise won't take a QSA's analysis at face value? Not at all. One of the major reasons that QSAs exist is because organizations need or want 3rd party assessments, and they trust those assessors to help them meet their PCI requirements.

3. As a result of economic downturn, what notable security projects are being cut from last years budget?

Training is being slowed down, and colleagues at other organizations note that they are cutting major initiatives - SIM/SEM technology, new IDS/IPS deployments, and other major hardware and software purchases are being delayed or are being re-scoped to highly critical areas. They're also getting more push to build internally.

The number of vendor calls, and the aggressiveness of those vendors is also increasing. I'm fielding more cold calls, and we're seeing things like the quick Google AdWord snap-ups following High Tower's demise.

I'm looking at the pullbacks as an opportunity - the frenetic pace of security device and technology deployment over the past few years has resulted in a wealth of existing information that frequently isn't as well leveraged as it could be.

5. Will secure code purchasing standards lead to secure code?

Sadly, no. I've seen some efforts along these lines, but I think that we'll see more success by putting testing tools into the hands of developers, as well as greater organizational maturity - secure code re-use for example.

As penalties for security issues become a more frequent topic of contractual negotations, this may begin to change. I've been advocating such a change in my own organization for a while.

Fun With Vundo: Checking Your Java Version

I've been receiving an increasing number of calls about Vundo infected systems. Vundo is an adware trojan, with a nasty habit of infecting machines with downlevel Java versions. As is often the case, many users either ignore the Java auto-updater, or are unaware that Java needs to be updated.

A quick and easy way to check is to visit the Java Tester at http://www.javatester.org/version.html. Your users need to be running a version higher than 1.5.0.7 (also known as version 5.0 release 7) .

Java versions can also be checked from the Control Panel by opening the Java panel.

Finally, users can also check each browser individually by manually checking their plugins.

• Firefox can be checked by going to Tools -> Add-ons -> Plugins.
• Internet Explorer is uglier - Tools -> Manage Add-Ons will leave you with a list that may include multiple Java versions.
  

Vundo has made its way into various ad networks, and users who normally browse relatively safely have been infected via their out of date Java versions. A typical infection includes:

• Popup ads
• Desktop background changes
• Screensaver changes
• Windows updates may be disabled
• Anti-malware and other security programs may be deleted or disable

Removal can typically be handled by a combination of Malwarebytes and bootable AV such as AVST's BART CD.

Parking Tickets and Social Engineering

(not the actual ticket - Creative Commons attribution licensed image courtesy singsing_sky)

Lenny Zeltser of the ISC reports that he recently investigated malware that was spread after victims visited a URL that was included on a parking violation flyer on their car. The BBC picked up the story, meaning copycats are far more likely as this hits major news media. Make sure you check out Lenny's article, as his malware analysis is always worth a read.

The bigger question is if we'll see more of this - I suspect yes. We've seen penetration testers use "lost" thumbdrives in parking lots to get into secure networks and the US military has banned thumb drives on some of their networks due to possible threats.. Now we've gone to the next level and rely on users typing in a URL to compromise their own machines. This would be particularly easy on college campuses or other venues during game days or other events, when many people receive parking tickets because they are unfamiliar with the parking rules, or may have parked in the wrong location.

The best technical fix for organizations is likely a combination of border URL filtering (or DNS blackholing), a good centrally managed AV solution, and strong host level anti-malware software. I've seen a lot of good results with Malwarebytes recently, particularly when removing trojans that the major AV companies miss or are unable to properly clean, and that's what I will be recommending to end users.

An Analysis of Firewall Rulebase (Mis)Management Practices

Mike Chapple, John D'Arcy, and Aaron Striegel, all from the University of Notre Dame recently published an article titled "An Analysis of Firewall Rulebase (Mis)Management Practices" (edit: link updated) in the ISSA Journal - described as the first widespread analysis of firewall management practices through a survey of firewall administrators and their supervisors.

According to the article, the survey was based on a series of open and closed ended questions which assessed the state of an organization's firewalls, their management practices, and the issues that were encountered with them. With 101 valid results, and 148 total respondents, this is a sizable survey of firewall administrators. In addition, they surveyed supervisors of firewall managers. In both cases, the distribution reached across industry.

Their findings are interesting -

• An average ruleset size double what it was in 2000.
• A high correlation between platform and ruleset size.
• A high turnover or churn rate for firewall changes.

Error rates were also a key part of the study - they found that 91% of administrators believed that least one error was introduced into their ruleset in the average month, and half of those administrators believe they go unfixed.

The article suggests that appropriate staffing levels and skillsets, as well as automated error detection are the best routes to fixing these issues. I would suggest a third step as well - a clear initial design and well defined rules for how rules are written, their syntax, and how they are tracked over time.

Overall, an interesting read for firewall administrators and supervisors or management of organizations with firewalls.

RFID and Passport Cloning in the Register

Edit: Paget's presentation is available at: http://video.google.com/videoplay?docid=-282861825889939203, and he notes that he is working with the Passport Cart, the Enhanced Technology Driver's License, and the other WHTI components - a different RFID technology than the US passport.

The Register took a trip with Chris Paget in San Francisco, and captured and cloned RFID tags - but it sounds like the cloning may have been limited to the tag ID, and not the content. As Paget notes, "It's mainly to defeat the argument that you can't do it in the real world, that there's no real-world attack here, that it's all theoretical."

As I've discussed previously, the US RFID enabled passport requires key data about individual users to release the actual content of the passport. I do not currently know of any implementation that trusts the RFID tag ID alone as an authenticator or identifier - but that doesn't meant that it might not be used that way, much as we've seen the SSN used widely.

The Register says that "Because the technology employs no encryption and can be read from distances of more than a mile, the tags are highly susceptible (PDF) to cloning and tracking, researchers have concluded". This isn't the case with the US passport RFID tags. Other RFID standards can allow reads from a longer distance, however the greatest distance that has been popularly announced for reading the 13.56 Mhz tags used in US passports is approximately 30 feet with specialized gear.

It is worth noting that in my own testing, the tag ID was often accessible from greater distances than the tag data was - and that at longer distances, I often got incorrect tag ID readings.

The Register points out that the card ID is a unique identifier, and could be used for tracking. Again, with a closed RFID blocking shield and highly limited range, this tracking would be difficult at best.The data contained in the passport is not highly sensitive - it includes birthdate, picture, and other details, but is not data beyond the scope of that which can be accessed in common online databases.

The ability to uniquely identify American passports is perhaps the greater danger, but again the limited range limits the threat to a 30 foot range with most practical readers.

In the end, Paget's work serves at yet another reminder that the technology, as implemented, has flaws that could be fixed. Passport tags should have a unique certificate to prevent cloning, and use of RFID should be carefully examined - in many cases it may not be the best technology available, or the design and usage models should be carefully considered.

XKCD: Security

XKCD fans have probably already seen this, but for those who haven't...


A wrench may or may not be an RFC compliant method of escrowed key retrieval.

Sony and Biometrics? Mofira

Engadget reports that Sony announced a finger vein biometric system that it calls "mofira". The Akihibaranews post about it describes it as a "The user-friendly technology offers quick response and high accuracy and comes in a compact size for mounting on mobile devices such as a personal computer or mobile phone.". The technology's claimed .1% false rejection rate, and .0001% false acceptance rate places it closer to an iris reader under ideal conditions, and far beyond most normal face, fingerprint, or hand geometry scanners.

The most interesting part isn't the capability of the technology though - what should catch our attention is that Sony is a major manufacturer of commodity consumer devices, including a wide range of cell phones and laptops, meaning that we might see it used in a variety of places. While Lenovo has used fingerprint scanners for some time on their corporate laptops, biometric authentication has not been widely adopted elsewhere. A low false rejection rate technology from a major consumer products company could change that.