Well it looks like the default in Jetty is going to remain that you must explicitly DENY the ciphers you don't want rather than enable those that you do want. This is against the principle of locking down everything first and then granting access only as needed. I would be worried that someone misspelled something or forgot to add something or new ciphers come along when you're not looking ...
Here is the response from the Jetty team:
The list of cipher suites available is determined by the security provider that is available in Java and by default it is the SunJSSE provider. Its not included in Jetty but in your Java installation itself. It is possible to use a third party provider but its not simple to install it (here are the details:
http://java.sun.com/j2se/1.5.0/docs/guide/security/jsse/JSSERefGuide.html#JCECust).
Thus, if you know the provider, you can just select the low level ciphers from the list of available ciphers provided by that provider. To see the list of available cipher suites in Java 1.5, just go to appendix A in the link above.
In appendix B, you'll see that Java has a list of allowed cipher suites for other providers. Java 5 will only allow third party providers as long as they support only those cipher suites in the list. You can just select the weak encryptions from this list and enumerate them in the excludeCipherSuites list so no one will be able to sneak in a weak encryption cipher.
Trends from the trenches of Internet traffic. Hackers, spammers and Internet abuse. IP address database. DNS sightings. Views and opinions expressed are my own. ~ Teri Radichel @teriradichel
Thursday, August 31, 2006
Sunday, August 27, 2006
Foiling Key Loggers & More McAfee Software Problems
I had this laptop that kept inserting letters when I tried to login. It would stick a bunch of extra letters in after every key I typed. Seemed like if I waited long enough then it would stop and I could login. Or if I rebooted six times. Sometimes it seemed like a certain combination of characters hit into the keyboard out of frustration would work but the combination was inconsistent so that was most likely a coincidence.
Needless to say, logging into my computer with these extra characters spewing out of my keyboard was a total waste of time. I was so annoyed I went and bought a new laptop.
Then wandering around the random Internet I happened across a white paper by Microsoft talking about messing up key loggers by inserting additional random characters as someone typed passwords into text boxes. AHA.
I had McAfee software installed and although I tried to uninstall it something was completely hosed on my machine and it didn't work right. There were still random services floating around that I would mostly ignore.
I went to start/run and typed msconfig to pull up start up programs and sure enough there were some McAfee services in there yet. I killed them all and removed them from automatic start up on my machine. Yep. That stopped the random characters from messing up my login.
This is not the first time I have had problems with McAfee and the feeling like it is more a foot in the door for hackers through their update process rather than a piece of security software. This feeling was justified in the case where their "enterprise" software had a serious vulnerability doing just such a thing. See other comments in past entries here.
And if you're having problems with extra characters appearing and getting in your way...msconfig and stop the McAfee services from auto start up.
Needless to say, logging into my computer with these extra characters spewing out of my keyboard was a total waste of time. I was so annoyed I went and bought a new laptop.
Then wandering around the random Internet I happened across a white paper by Microsoft talking about messing up key loggers by inserting additional random characters as someone typed passwords into text boxes. AHA.
I had McAfee software installed and although I tried to uninstall it something was completely hosed on my machine and it didn't work right. There were still random services floating around that I would mostly ignore.
I went to start/run and typed msconfig to pull up start up programs and sure enough there were some McAfee services in there yet. I killed them all and removed them from automatic start up on my machine. Yep. That stopped the random characters from messing up my login.
This is not the first time I have had problems with McAfee and the feeling like it is more a foot in the door for hackers through their update process rather than a piece of security software. This feeling was justified in the case where their "enterprise" software had a serious vulnerability doing just such a thing. See other comments in past entries here.
And if you're having problems with extra characters appearing and getting in your way...msconfig and stop the McAfee services from auto start up.
Wednesday, August 23, 2006
Online Advertising - Click Fraud
Here's a good article on the issues surrounding click fraud - the clicks you pay for at sites like Google, MSN and Yahoo and pages like this with the ads on the side of the page (or wherever).
Click Fraud
This is a serious issue for businesses because it can drain a lot of revenue. I once put up and ad and wasn't watching it and the amount billed in two days was something like $600.00 for Christmas decorations. I cannot believe all that was legitimate, however Google claimed it was and I didn't have the proper logs to look into it. I never had such an issue so didn't bother in the past.
More recently I have found that in competitive spaces like the online travel industry, online advertising is a significant part of the cost of doing business. The ads are very expensive based on the amount of clicks received.
Even worse is the web development space where you have to spend $2.50 per click just to get on the board. Something is wrong with that picture - and I got no leads for a huge amount of expense which just doesn't seem right.
Of interest is that recently I got a letter in the mail about a class action law suit against Google to get money back for fraudulent clicks. Hmm. Some lawyer will make a lot of money. The more alarming thing to me was that this letter stated I either had to send in a letter to remove myself from the suit, otherwise I would be a part of this suit and could never again sue Google for this reason. Well if I send in a letter is Google going to see that and shut down my advertising so they won't get sued? And what if I join the suit but I don't have any click fraud that I know of. I don't get any money now but I may have a click fraud issue later? I would like to think that Google is angelic and all that but reality is...Enron happens. The nice thing for Google is they basically settle this suit, pay a bunch of money, and can never be sued again for all the people who didn't see the letter or respond to it. And for those that did they might just close those people's accounts. It's always the little guy getting burned no matter which way you look at it. I saw subsequent similar letters for other online advertising services.
Click fraud is a serious issue for businesses. Not only do you have to ensure you aren't paying for fraudulent clicks, however, you have to make sure your site is secure, because if you are pouring a lot of money into advertising and someone else can redirect your visitors to another site - you're paying for their advertising.
Click Fraud
This is a serious issue for businesses because it can drain a lot of revenue. I once put up and ad and wasn't watching it and the amount billed in two days was something like $600.00 for Christmas decorations. I cannot believe all that was legitimate, however Google claimed it was and I didn't have the proper logs to look into it. I never had such an issue so didn't bother in the past.
More recently I have found that in competitive spaces like the online travel industry, online advertising is a significant part of the cost of doing business. The ads are very expensive based on the amount of clicks received.
Even worse is the web development space where you have to spend $2.50 per click just to get on the board. Something is wrong with that picture - and I got no leads for a huge amount of expense which just doesn't seem right.
Of interest is that recently I got a letter in the mail about a class action law suit against Google to get money back for fraudulent clicks. Hmm. Some lawyer will make a lot of money. The more alarming thing to me was that this letter stated I either had to send in a letter to remove myself from the suit, otherwise I would be a part of this suit and could never again sue Google for this reason. Well if I send in a letter is Google going to see that and shut down my advertising so they won't get sued? And what if I join the suit but I don't have any click fraud that I know of. I don't get any money now but I may have a click fraud issue later? I would like to think that Google is angelic and all that but reality is...Enron happens. The nice thing for Google is they basically settle this suit, pay a bunch of money, and can never be sued again for all the people who didn't see the letter or respond to it. And for those that did they might just close those people's accounts. It's always the little guy getting burned no matter which way you look at it. I saw subsequent similar letters for other online advertising services.
Click fraud is a serious issue for businesses. Not only do you have to ensure you aren't paying for fraudulent clicks, however, you have to make sure your site is secure, because if you are pouring a lot of money into advertising and someone else can redirect your visitors to another site - you're paying for their advertising.
Jetty Cipher Suite Handling
In the latest version of Jetty rc1 it appears that the method setCipherSuites was removed and replaced with excludeCipherSuites.
Cipher suites allow the web server to use different types of encryption. If you are allowing weak encryption on your web server - you'll want to fix this.
In the case of the latest version of Jetty now you have to think of and exclude every possible cipher suite instead of just specifying those you want to allow. This is very poor security.
The way to handle security is to first disallow everything, then specify the things you want to allow explicitly.
Microsoft has this in their top 10 application security problems list however they also do not follow this principle in regards to DCOM and RPC. Functions which are not required should always be disabled - especially those which can clearly be hacked, and administrators should be given the option to enable these things when needed.
In the case of Jetty I hope this was an oversight because this seems to be a well engineered application for the most part, however their use of certain non-standard third party tools does worry me at times. I hope they have checked every line of code inside and out.
Jetty is not the only organization doing this of course. I have written about many PHP frameworks which are on many more vulnerability lists!
Cipher suites allow the web server to use different types of encryption. If you are allowing weak encryption on your web server - you'll want to fix this.
In the case of the latest version of Jetty now you have to think of and exclude every possible cipher suite instead of just specifying those you want to allow. This is very poor security.
The way to handle security is to first disallow everything, then specify the things you want to allow explicitly.
Microsoft has this in their top 10 application security problems list however they also do not follow this principle in regards to DCOM and RPC. Functions which are not required should always be disabled - especially those which can clearly be hacked, and administrators should be given the option to enable these things when needed.
In the case of Jetty I hope this was an oversight because this seems to be a well engineered application for the most part, however their use of certain non-standard third party tools does worry me at times. I hope they have checked every line of code inside and out.
Jetty is not the only organization doing this of course. I have written about many PHP frameworks which are on many more vulnerability lists!
Friday, August 18, 2006
Are You Getting All Your Email?
I have this vision for a new company - maybe someone can take my idea for free and run with it. I am having problems getting some email right now from a vendor. In the past I have had problems getting emails from other companies. There are various companies set up to check your web site content from different locations. It would be cool if there was a company that was not too expensive that would send you emails from different places and you could see online from where and when they sent them to validate you are getting all the email you think you should be. It would need to be something random so that the company stealing your email doesn't realize it's a verification email. Sounds like spam doesn't it?? Actually I think it's more like a secret shopper.
Tuesday, August 15, 2006
More PHP Hacks: Better Web Systems
Lieberman's site was hacked on the eve of his defeat in the race for US Senator. You can read more about it here:
PHP Hacks
I wrote previously about how I hate PHP becuase it is this free software with all these neat widgets which script loving programmers and web site owners who many not be programmers at all hack together into something that externally - looks like a web site. Ok it is a web site.
Well, if you're running a web site for the neighborhood street party maybe that is ok. But using someone who is not on top of ALL the issues in building and maintaining secure and solid web sites, and you're basing your whole career off this web site...good luck.
The problem here was that someone threw together a PHP web site (so you can guess it was cheap...) and didn't apply a patch that came out that would have prevented the whole problem. Too often people set up a web site and then think they can never pay attention to it again. Not true.
Whatever software you are running, besides your automatically updated Windows operating system, is potentially hackable and must be managed and monitored if you don't want someone to hack it.
And as mentioned previously I have somewhat of a disdain for PHP for various reasons. There are some good PHP programmers but seems more bad than good and more hacks than most other languages.
You get what you pay for.
PHP Hacks
I wrote previously about how I hate PHP becuase it is this free software with all these neat widgets which script loving programmers and web site owners who many not be programmers at all hack together into something that externally - looks like a web site. Ok it is a web site.
Well, if you're running a web site for the neighborhood street party maybe that is ok. But using someone who is not on top of ALL the issues in building and maintaining secure and solid web sites, and you're basing your whole career off this web site...good luck.
The problem here was that someone threw together a PHP web site (so you can guess it was cheap...) and didn't apply a patch that came out that would have prevented the whole problem. Too often people set up a web site and then think they can never pay attention to it again. Not true.
Whatever software you are running, besides your automatically updated Windows operating system, is potentially hackable and must be managed and monitored if you don't want someone to hack it.
And as mentioned previously I have somewhat of a disdain for PHP for various reasons. There are some good PHP programmers but seems more bad than good and more hacks than most other languages.
You get what you pay for.
Sunday, August 13, 2006
A different View of Netcraft Server Usage Rankings
Here's a twist on how to view the Netcraft rankings that tell you how many of each type of server (IIS, Jboss, Jetty, Apache, Tomcat, etc) are being used on the Internet.
The way these rankings are gathered is by scouring the web and pinging each web server to determine what type it is to add to the statistics.
Consider that a properly secured configuration will not advertising this information because then as new vulnerabilities are announced, hackers will use this information and scour the Internet (the same way Netcraft does) looking for these types of servers so they can attempt to exploit that vulnerability.
So instead of thinking, hey most people use IIS so I'm going to use that too, you can think, geez IIS has the most insecure installations therefore there are more IIS admins that don't know what they are doing than other types of web servers in terms of security.
By the way I haven't looked to see which type of server is most widely used right now. IIS is just an example. It is probably one of the free web servers like apache - which is a good web server for certain uses. The problem is not with the server itself. The problem is with administrators who are not properly trained on implementing secure configurations of their web servers.
I for one, knew my limitations and hired a managed hosting company, thinking they would have all the answers to make my systems secure so I could focus on development. Not so. Your application developers need to be aware of application issues and your internal staff and/or external auditors need to be checking everything your managed hosting company is doing. People at managed hosting companies can make mistakes, as well as the possibility of internal security breaches.
So secure your web server by hiding the implementation from prying eyes, including Netcraft unfortunately. Additionally, run security audits and don't assume your administrator or your managed hosting company can find every single problem. Security is a tough issue that requires constant monitoring and updating to keep up with the hackers.
The way these rankings are gathered is by scouring the web and pinging each web server to determine what type it is to add to the statistics.
Consider that a properly secured configuration will not advertising this information because then as new vulnerabilities are announced, hackers will use this information and scour the Internet (the same way Netcraft does) looking for these types of servers so they can attempt to exploit that vulnerability.
So instead of thinking, hey most people use IIS so I'm going to use that too, you can think, geez IIS has the most insecure installations therefore there are more IIS admins that don't know what they are doing than other types of web servers in terms of security.
By the way I haven't looked to see which type of server is most widely used right now. IIS is just an example. It is probably one of the free web servers like apache - which is a good web server for certain uses. The problem is not with the server itself. The problem is with administrators who are not properly trained on implementing secure configurations of their web servers.
I for one, knew my limitations and hired a managed hosting company, thinking they would have all the answers to make my systems secure so I could focus on development. Not so. Your application developers need to be aware of application issues and your internal staff and/or external auditors need to be checking everything your managed hosting company is doing. People at managed hosting companies can make mistakes, as well as the possibility of internal security breaches.
So secure your web server by hiding the implementation from prying eyes, including Netcraft unfortunately. Additionally, run security audits and don't assume your administrator or your managed hosting company can find every single problem. Security is a tough issue that requires constant monitoring and updating to keep up with the hackers.
Validating Click To Call Advertising Charges
I set up a pay per call account with this online advertiser and after a couple of months I was billed for a couple of calls. No big deal right? Couldn't cost that much? Well the problem is - I didn't get these supposed leads. I had no additional business, no messages, and no record of the phone calls in my logs. I only had some calls from some marketing research company in Canada. I wondered if they were calling and creating the charges and wanted to complain about that.
However instead, I must now complain about the advertising company. I emailed them and told them I think I was billed incorrectly because I hadn't gotten any "leads". However just to make sure I asked for the phone records so I could match them up to my phone calls and determine if I had actually received calls from other sales people rather than actual leads and that was the source of this whole thing. Maybe that research company is using their list and generating charges for people - in which case they need to stop!
Instead of simply sending me the phone logs or telling me where I could find them, the advertising company emailed me and told me to call them. I told them I couldn't right now because I'm on a contract during the day where I can't take/make phone calls and additionally, I am super busy. I use my lunch hours and any extra time to get projects done. Could they please just send me the phone records and I would look into it later.
Then they tell me they can't provide the phone records like the number that called me - for "privacy" reasons. What the heck? What kind of phone service doesn't provide you record of the calls you are being charged for? Does anyone see anything wrong with this picture? They could tell me I got 100 phone calls and have no way to prove it and I am supposed to just pay it? Even with pay per click advertising you can track back clicks to their source and validate you are getting the clicks you are paying for. Same should be true for phone.
Additionally this company told me that my phone line would not allow them to leave a message. That's odd. I have messages from this research company, vendors, etc. I also have hang up messages (clicks) from their number so if I can get the hang up why couldn't they speak and leave a message? However I realize something may have been wrong with the phone line and need to call the company providing me with that service in that case, so I asked them exactly how they tried to leave a message so I could resolve it. Were they on the main extension and didn't select a particular extension or what?
Additionally I sent some suggestions for making the service better and why it would make more sense if they could provide the phone logs. For instance if someone placed a call and didn't leave a message you could use the phone number in the logs to call them back. If nothing else you could validate that you actually did receive the calls you are being charged for. I asked if she could pass that message on because I think it would be valuable for marketers to be able to track the source of their leads and make this online advertising service more valuable if it could be associated with dollar value in terms of new sales.
In the meantime I said I would try to login and see if there was some information in the system I could match up to my phone logs to figure out what happened.
So what did they do? Did they answer my question about the voicemail so I can fix it? Did they pass my message along? Did they tell me how they tried to leave a message so I could resolve that problem on my end (if it was on my end)? Did they allow me to log in and find potential answers to my questions -- OK I should have looked there first but I didn't realize they had stats in their online system and actually just forgot about it altogether so I will say shame on me for that. But apparently the info I needed was not there anyway from what she told me.
But no...she deactivated my account and refunded all the money before I had a chance to log in. Hmmm... I did not ask for this. I did not refuse to pay the charges if they are legitimate. I did not even refuse to pay the charges if they were wrong! I was just trying to understand how they track these things because I didn't have record of these calls they were charging me for.... I just wanted to see where they are coming from!
Could it be that they closed my account because there were no record of these calls? Before I could login and prove it??
If you are paying for "pay for call" advertising online - check that the service you are using can actually prove that you are getting the calls for which you are getting billed.
Maybe this company is not even doing it intentionally...but they should think about and change the service so people can verify the charges they are receiving. The other thing is that competitors may be clicking on this link to generate invalid charges and there needs to be a way to trace this back to the source and make it stop if that is happening. This services provides no recourse for doing so. We simply have to pay for the fraud with everything else.
However instead, I must now complain about the advertising company. I emailed them and told them I think I was billed incorrectly because I hadn't gotten any "leads". However just to make sure I asked for the phone records so I could match them up to my phone calls and determine if I had actually received calls from other sales people rather than actual leads and that was the source of this whole thing. Maybe that research company is using their list and generating charges for people - in which case they need to stop!
Instead of simply sending me the phone logs or telling me where I could find them, the advertising company emailed me and told me to call them. I told them I couldn't right now because I'm on a contract during the day where I can't take/make phone calls and additionally, I am super busy. I use my lunch hours and any extra time to get projects done. Could they please just send me the phone records and I would look into it later.
Then they tell me they can't provide the phone records like the number that called me - for "privacy" reasons. What the heck? What kind of phone service doesn't provide you record of the calls you are being charged for? Does anyone see anything wrong with this picture? They could tell me I got 100 phone calls and have no way to prove it and I am supposed to just pay it? Even with pay per click advertising you can track back clicks to their source and validate you are getting the clicks you are paying for. Same should be true for phone.
Additionally this company told me that my phone line would not allow them to leave a message. That's odd. I have messages from this research company, vendors, etc. I also have hang up messages (clicks) from their number so if I can get the hang up why couldn't they speak and leave a message? However I realize something may have been wrong with the phone line and need to call the company providing me with that service in that case, so I asked them exactly how they tried to leave a message so I could resolve it. Were they on the main extension and didn't select a particular extension or what?
Additionally I sent some suggestions for making the service better and why it would make more sense if they could provide the phone logs. For instance if someone placed a call and didn't leave a message you could use the phone number in the logs to call them back. If nothing else you could validate that you actually did receive the calls you are being charged for. I asked if she could pass that message on because I think it would be valuable for marketers to be able to track the source of their leads and make this online advertising service more valuable if it could be associated with dollar value in terms of new sales.
In the meantime I said I would try to login and see if there was some information in the system I could match up to my phone logs to figure out what happened.
So what did they do? Did they answer my question about the voicemail so I can fix it? Did they pass my message along? Did they tell me how they tried to leave a message so I could resolve that problem on my end (if it was on my end)? Did they allow me to log in and find potential answers to my questions -- OK I should have looked there first but I didn't realize they had stats in their online system and actually just forgot about it altogether so I will say shame on me for that. But apparently the info I needed was not there anyway from what she told me.
But no...she deactivated my account and refunded all the money before I had a chance to log in. Hmmm... I did not ask for this. I did not refuse to pay the charges if they are legitimate. I did not even refuse to pay the charges if they were wrong! I was just trying to understand how they track these things because I didn't have record of these calls they were charging me for.... I just wanted to see where they are coming from!
Could it be that they closed my account because there were no record of these calls? Before I could login and prove it??
If you are paying for "pay for call" advertising online - check that the service you are using can actually prove that you are getting the calls for which you are getting billed.
Maybe this company is not even doing it intentionally...but they should think about and change the service so people can verify the charges they are receiving. The other thing is that competitors may be clicking on this link to generate invalid charges and there needs to be a way to trace this back to the source and make it stop if that is happening. This services provides no recourse for doing so. We simply have to pay for the fraud with everything else.
Thursday, August 03, 2006
International Crime Ring - The Web Mob
More correlations between all the data I have been presenting or almost a year now (go back to my very first story and the speculations about coordinated crime efforts spawning from Russia, China and elsewhere) can be found in this report:
FBI Discusses International Web Crime
My take that the next war will be an information war is being played out in references to Internet crime "cells" similar to terrorist network cells. My speculation further suggests that these "cells" are related to terrorist cells trying to produce nuclear bombs and weapons.
It's always about power and money isn't it? Sometimes I wish I was blissfully oblivious but I can't help what I see. And it all started by digging into the network of spam drowning my emails last year. The trends...the networks involved...the targets...the messages...I knew it was somehow coordinated.
Piece by piece the random Internet connections are connecting into a puzzle that is starting to form comprehensible and recognizable images that explain what is really going on.
The Internet is the new Wild, Wild West ... the new digital mob ... a new form of drug lords that want to rule the world ... a new brand of espionage and terrorism predicted in war games but very much an understatement in terms of the reach and complexity of the network and crimes involved.
FBI Discusses International Web Crime
My take that the next war will be an information war is being played out in references to Internet crime "cells" similar to terrorist network cells. My speculation further suggests that these "cells" are related to terrorist cells trying to produce nuclear bombs and weapons.
It's always about power and money isn't it? Sometimes I wish I was blissfully oblivious but I can't help what I see. And it all started by digging into the network of spam drowning my emails last year. The trends...the networks involved...the targets...the messages...I knew it was somehow coordinated.
Piece by piece the random Internet connections are connecting into a puzzle that is starting to form comprehensible and recognizable images that explain what is really going on.
The Internet is the new Wild, Wild West ... the new digital mob ... a new form of drug lords that want to rule the world ... a new brand of espionage and terrorism predicted in war games but very much an understatement in terms of the reach and complexity of the network and crimes involved.
Wednesday, August 02, 2006
JSP Vulernability
Besides DCOM I am wondering if there is some type of security problem with JSP. In one of my last entries you'll see some comments from people about various hosting companies. One of them mentions problems at a company I also have had problems with. They also mention that they wonder whether the problem stems from a JSP application.
Two things come to mind after reading this statement.
#1. That hosting company is partnered with JBoss, and open source Java Application Server that serves up JSP. They must have some expertise in that area - and potentially some people who are aware of known hacks who may have internal access at the organization.
#2. Maybe there is some sort of flaw in JSP...which was something I was starting to wonder prior to reading this. The thing about JSP is that it is compiled after the fact and there are some temporary files that contain the compiled code. What this means is that if someone can get into your cache off compiled JSP pages, they could potentially change those cached pages and alter the functionality of your application. You wonder what is going on so you do a diff on your code and it all looks the same...but in reality what was altered was the cached files. In the past I have found permissions changed on these cached files as well so they could not be deleted. That means that the code you think you are running may not be the code you are actually running.
#2 does not just apply to JSP but any programming language that compiles at run time. There needs to be a way to verify that the cache has not been poisoned.
So don't use JSP? I don't think that is the answer here because so many other application programs work in a similar way. In terms of Java application servers you could opt for using servlets. You can also perform some security auditing on your system to verify this is not happening.
Two things come to mind after reading this statement.
#1. That hosting company is partnered with JBoss, and open source Java Application Server that serves up JSP. They must have some expertise in that area - and potentially some people who are aware of known hacks who may have internal access at the organization.
#2. Maybe there is some sort of flaw in JSP...which was something I was starting to wonder prior to reading this. The thing about JSP is that it is compiled after the fact and there are some temporary files that contain the compiled code. What this means is that if someone can get into your cache off compiled JSP pages, they could potentially change those cached pages and alter the functionality of your application. You wonder what is going on so you do a diff on your code and it all looks the same...but in reality what was altered was the cached files. In the past I have found permissions changed on these cached files as well so they could not be deleted. That means that the code you think you are running may not be the code you are actually running.
#2 does not just apply to JSP but any programming language that compiles at run time. There needs to be a way to verify that the cache has not been poisoned.
So don't use JSP? I don't think that is the answer here because so many other application programs work in a similar way. In terms of Java application servers you could opt for using servlets. You can also perform some security auditing on your system to verify this is not happening.
DCOM - Vulnerability #1
I am starting to think DCOM is a real security hazard. Every hosting company I talk to seems afraid to touch it. The one I talked to last said disabling it can "cripple the OS". The one I talked to before that said it could be "disabled no problem". So which is it?
And by the way I didn't ask to disable DCOM. I just want it to be secure so someone can't use it to launch rogue applications like they did on my box at the last hosting company. Someone was able to launch apps that were sending spam and who knows what else (see previous topics) using DCOM.
I am not sure how they got those apps on the box in the first place - I know they were launched through DCOM however they could have been installed by other means. Was it through my app or someone internal to the organization who had access to the machine? I also find it interesting that they say they have no knowledge or understanding of my web application and I find this to be a crock of you know what since I recently found an article saying they are partnered with the company who wrote my application server. Since they are partnered up with JBoss they probably have some internal or closely related people over there who are very aware of any known hacks should they want to take this hacker action to steal my money. (Which was clearly happening for three months over there and I am not yet positive it has been resolved).
But back to DCOM.
SO whose responsibility is DCOM anyway? It's kind of an application thing. Something people use to write apps that connect to and talk to each other over the Internet and a way to launch remote applications. However it ships with the OS and so in my opinion, if a hosting company is claiming that it is going to "harden the OS" for you and manage security then security DCOM from launching rogue applications and being left unnecessarily accessible if the client is not using it is an issue that the hosting company should address.
So far not one single company I have talked to has anything about DCOM or RPC in their OS hardening policies. This is clearly a fact that hackers are taking advantage of based on my experience.
Additionally if changing DCOM settings can "cripple the OS" why is there no clear documentation from Microsoft on how to correctly secure DCOM and a more simple way to figure out what apps are using it and if it can be safely disabled on a machine where it is not needed. The documentation on the Microsoft web site is even sketchy - warning that disabling DCOM may cause problems - but not clearly defining those problems so a person can make a technical and accurate decision as to whether disabling it is the correct thing to do or not.
And as argued before, you should not be able to do something on the OS that allows you to "cripple" your machine via the user interface. I understand if you are changing registry settings or something like that. But changing security in the OS settings? What's the point of a user interface. It should have some application logic to prevent this and a way to safely back it out if they aren't going to prevent it.
And by the way I didn't ask to disable DCOM. I just want it to be secure so someone can't use it to launch rogue applications like they did on my box at the last hosting company. Someone was able to launch apps that were sending spam and who knows what else (see previous topics) using DCOM.
I am not sure how they got those apps on the box in the first place - I know they were launched through DCOM however they could have been installed by other means. Was it through my app or someone internal to the organization who had access to the machine? I also find it interesting that they say they have no knowledge or understanding of my web application and I find this to be a crock of you know what since I recently found an article saying they are partnered with the company who wrote my application server. Since they are partnered up with JBoss they probably have some internal or closely related people over there who are very aware of any known hacks should they want to take this hacker action to steal my money. (Which was clearly happening for three months over there and I am not yet positive it has been resolved).
But back to DCOM.
SO whose responsibility is DCOM anyway? It's kind of an application thing. Something people use to write apps that connect to and talk to each other over the Internet and a way to launch remote applications. However it ships with the OS and so in my opinion, if a hosting company is claiming that it is going to "harden the OS" for you and manage security then security DCOM from launching rogue applications and being left unnecessarily accessible if the client is not using it is an issue that the hosting company should address.
So far not one single company I have talked to has anything about DCOM or RPC in their OS hardening policies. This is clearly a fact that hackers are taking advantage of based on my experience.
Additionally if changing DCOM settings can "cripple the OS" why is there no clear documentation from Microsoft on how to correctly secure DCOM and a more simple way to figure out what apps are using it and if it can be safely disabled on a machine where it is not needed. The documentation on the Microsoft web site is even sketchy - warning that disabling DCOM may cause problems - but not clearly defining those problems so a person can make a technical and accurate decision as to whether disabling it is the correct thing to do or not.
And as argued before, you should not be able to do something on the OS that allows you to "cripple" your machine via the user interface. I understand if you are changing registry settings or something like that. But changing security in the OS settings? What's the point of a user interface. It should have some application logic to prevent this and a way to safely back it out if they aren't going to prevent it.
Managed Hosting Companies - Internal Employee Access Policies
The saga continues...In search of a new managed hosting company.
Seems like most companies do not have well documented processes in terms of how and when employees can access managed systems and how this access is audited. To me I find this scary. I am working with some mid range hosting companies that support multi-million dollar businesses. I know because the reason I found out about one of these companies was through one of my $150 million per year clients.
One company was able to have a tech respond to me and outline the process. The company I was at previously could not articulate their processes and apparently did not have them written down anywhere - or want to provide me these documents in writing - because they constantly wanted to call me. The third company I am speaking to tells me that they have very stringent processes but no customer facing documents to explain these processes.
Since system administration is one of the very weakest points in the whole process - typically errors and hacks are caused by humans and most easily someone who has open access to the machine already - this is a huge problem! Yes so someone can't get into the building because you have biometric controls and chainlink fence lockers and separately locked cabinets. So what if your administrator is the one causing the problem!
This was highlighted by an instance at Internap that took down their whole Fisher Plaza facility one fine Friday evening - when I just happened to have a potential customer looking at my web site and freaking out, thinking I am some fly by night operation. Someone who had access to the building already went and flipped off the power switch somehow and for whatever reason in such a way that the generators didn't kick in. Seems they pushed that big red button that says "do not push" all over it way up in the air and Internap reported to me that it was "an accident"?? Hmm.
Internap is a good company but things happen. In "Who Says Elephants Can't Dance" Lou Gerstner says "People do what you INSPECT, not what you EXPECT." I wholeheartdly believe this after being ripped off by some of my own employees. Hosting companies want me to "just trust them" but that is foolish. You need to have good auditing in place in your hosting environment for true security - both internally and externally.
Seems like most companies do not have well documented processes in terms of how and when employees can access managed systems and how this access is audited. To me I find this scary. I am working with some mid range hosting companies that support multi-million dollar businesses. I know because the reason I found out about one of these companies was through one of my $150 million per year clients.
One company was able to have a tech respond to me and outline the process. The company I was at previously could not articulate their processes and apparently did not have them written down anywhere - or want to provide me these documents in writing - because they constantly wanted to call me. The third company I am speaking to tells me that they have very stringent processes but no customer facing documents to explain these processes.
Since system administration is one of the very weakest points in the whole process - typically errors and hacks are caused by humans and most easily someone who has open access to the machine already - this is a huge problem! Yes so someone can't get into the building because you have biometric controls and chainlink fence lockers and separately locked cabinets. So what if your administrator is the one causing the problem!
This was highlighted by an instance at Internap that took down their whole Fisher Plaza facility one fine Friday evening - when I just happened to have a potential customer looking at my web site and freaking out, thinking I am some fly by night operation. Someone who had access to the building already went and flipped off the power switch somehow and for whatever reason in such a way that the generators didn't kick in. Seems they pushed that big red button that says "do not push" all over it way up in the air and Internap reported to me that it was "an accident"?? Hmm.
Internap is a good company but things happen. In "Who Says Elephants Can't Dance" Lou Gerstner says "People do what you INSPECT, not what you EXPECT." I wholeheartdly believe this after being ripped off by some of my own employees. Hosting companies want me to "just trust them" but that is foolish. You need to have good auditing in place in your hosting environment for true security - both internally and externally.
Tuesday, August 01, 2006
Managed Hosting Companies - Comparison
Here are some postings about potential managed hosting companies. Please note that I did not participate in this discussion. I am currently in the process of researching and evaluating new potential hosting companies in order to find one that can provide better security configuration and resolve some of the problems mentioned in past articles.
Managed Hosting - Comparison
It is very difficult to find a hosting company that sounds confident in their ability completely secure DCOM based on the applications I am running. I know what the potential settings are but am not sure why setting them a certain way crashes a server. Additionally it is unclear what settings must be left turned on for the applications at the managed hosting companies - most of them don't even know if their applications require DCOM or not.
Managed Hosting - Comparison
It is very difficult to find a hosting company that sounds confident in their ability completely secure DCOM based on the applications I am running. I know what the potential settings are but am not sure why setting them a certain way crashes a server. Additionally it is unclear what settings must be left turned on for the applications at the managed hosting companies - most of them don't even know if their applications require DCOM or not.
Sunday, July 30, 2006
Shopping Cart Vulnerabilities
This article gives a good run down of various shopping cart vulnerabilities. Take a look and make sure your provider is taking care of the following top security problems with e-commerce web sites: E-commerce Web Site Security
Thursday, July 27, 2006
Microsoft's Top 10 Security Problems
Here's a summary of Microsoft's top 10 security problems coming through their help desk:
Microsoft top 10 Security Problems
Microsoft top 10 Security Problems
Wednesday, July 26, 2006
Monday, July 24, 2006
Netcraft
Although netcraft provides up-time for hosting companies - there is a lot that netcraft uptime rankings do not tell you.
If the update is reporting a Linux server, and you are running Windows, how does the company rate on Windows uptime and vice versa?
Although a specific box may remain online for a very long time, that means the box hasn't been rebooted and therefore security patches have not been properly installed in a timely manner - correct?
This uptime report tells you nothing about a company's internal security policies and practices, which some may find in terms of lost revenue to be more important than uptime alone.
If the update is reporting a Linux server, and you are running Windows, how does the company rate on Windows uptime and vice versa?
Although a specific box may remain online for a very long time, that means the box hasn't been rebooted and therefore security patches have not been properly installed in a timely manner - correct?
This uptime report tells you nothing about a company's internal security policies and practices, which some may find in terms of lost revenue to be more important than uptime alone.
Friday, July 21, 2006
Hack Canada
I found this site today through a very round about means which I won't bother to explain. I don't quite get the reason for the site - to be honest I don't have time to bother with it - but I did notice that one article claims the US government is begging hackers in Canada to hack for them. I'll let someone else decide if this is true or not. All I know is that there are a lot of hackers coming out of Canada - especially the middle of Canada. I seem to recall some of them not seeming like they came from Canadian origin. More research is needed.
Hack Canada
Hack Canada
Thursday, July 20, 2006
DLL Injections
I ran across this posting on sysinternals.com which, according to my hosting company, is a respected source. For some reason the posting has been removed but I was able to pull up the topic from the Google cache - for however long this works:
DLL Injection
Basically here's the info:
Someone read about a utility called InjectedDLL from www.nirsoft.net which provides a list of DLL files injected into other processes. The writer had not heard of DLL injecting before but apparently it's quite common method use by Malware infections.
He wanted more info.
Here are some responses:
DLL loads in address space of the process. Then loads all of its dependency modules and then dll entry point called.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs key (WinAll)
provides list of dll that injects to any started process automatically by windows
other method - call CreateRemoteThread function.
call FreeLibrary by CreateRemoteThread
DLL injection usualy uses CreateRemoteThread/WriteProcessMemory technic. When DLL injected it is initializes and execute its code.
The code: codeproject
another dll injection example
DLL Injection
Basically here's the info:
Someone read about a utility called InjectedDLL from www.nirsoft.net which provides a list of DLL files injected into other processes. The writer had not heard of DLL injecting before but apparently it's quite common method use by Malware infections.
He wanted more info.
Here are some responses:
DLL loads in address space of the process. Then loads all of its dependency modules and then dll entry point called.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs key (WinAll)
provides list of dll that injects to any started process automatically by windows
other method - call CreateRemoteThread function.
call FreeLibrary by CreateRemoteThread
DLL injection usualy uses CreateRemoteThread/WriteProcessMemory technic. When DLL injected it is initializes and execute its code.
The code: codeproject
another dll injection example
Monitoring Keyboard and Mouse Events
Look how easy Microsoft makes it to monitor keyboard and mouse events - how nice of them:
Windows Keyboard and Mouse Hooks
Ok but you'd have to have access to install stuff on the box you say...
Well if you read my blog about the managed hosting company I've been using...then you may start to understand my concerns. Outsourcing your hosting to a managed hosting company is lovely - if you trust them. You want to trust them - but can you? Read my information about life at a managed hosting company and decide for yourself.
So how can we balance out getting someone else to manage our servers while protecting our privacy and data?
It would be nice if Microsoft provided more detailed logging of what was installed and when, and also means to clearly distinguish what DLLs go with what programs, for instance.
Additionally how can we be sure someone is not tracking our events with the code noted above? How can we be sure they are doing this only if we have given them authority to do so?
Windows Keyboard and Mouse Hooks
Ok but you'd have to have access to install stuff on the box you say...
Well if you read my blog about the managed hosting company I've been using...then you may start to understand my concerns. Outsourcing your hosting to a managed hosting company is lovely - if you trust them. You want to trust them - but can you? Read my information about life at a managed hosting company and decide for yourself.
So how can we balance out getting someone else to manage our servers while protecting our privacy and data?
It would be nice if Microsoft provided more detailed logging of what was installed and when, and also means to clearly distinguish what DLLs go with what programs, for instance.
Additionally how can we be sure someone is not tracking our events with the code noted above? How can we be sure they are doing this only if we have given them authority to do so?
Tuesday, July 18, 2006
Mcafee Vulnerability
Today I read about a flaw that supposedly went unused and unnoticed in the Enterprise version of McAfee:
Mcafee Vulnerability
Interestingly enough this exploit allows control over the machine to steal files and data.
Based on personal experience, other versions of McAfee may have issues as well. I can't pinpoint it, but when I install the software, I have problems.
This is really sad because McAfee has some cool concepts in their firewall software, for instance.
Mcafee Vulnerability
Interestingly enough this exploit allows control over the machine to steal files and data.
Based on personal experience, other versions of McAfee may have issues as well. I can't pinpoint it, but when I install the software, I have problems.
This is really sad because McAfee has some cool concepts in their firewall software, for instance.
Check for Programs Hidden From Event Logs
I found another problem on my server today - the server that was just rebuilt and then my hosting company somehow ran my app as administrator even though I was very adamant it should not be.
Was it my hosting company that did this, or someone who accessed my server through the app or some other security hole...I don't know...but I went into the program error logging and some "invisible" program was set to not log errors in the Microsoft event logs.
You can check for this issue on your box by going to your system properties, click on advanced, and click on error reporting. Click the "choose programs" button to see if any programs you did not place in this area have been added to be excluded from error reporting.
Was it my hosting company that did this, or someone who accessed my server through the app or some other security hole...I don't know...but I went into the program error logging and some "invisible" program was set to not log errors in the Microsoft event logs.
You can check for this issue on your box by going to your system properties, click on advanced, and click on error reporting. Click the "choose programs" button to see if any programs you did not place in this area have been added to be excluded from error reporting.
Saturday, July 15, 2006
Hosting Companies - People Vulnerabilities
Yesterday my server was completely rebuilt by my hosting company due to a totally messed up system. (See previous articles if you want the gory details.)
The whole rebuild was caused by over three months of security issues (see my previous articles for the gory details).
Not even 24 hours after this reinstall my hosting company support staff opened up various security holes on the system. Maybe they were inadvertent, new untrained staff, or whatever but it is my server and my business that is hurt by their "minor" or "not so minor" lapses. They can say they are sorry. I lose time and money.
Here's what happened.
First I think their system for tracking passwords isn't working, but I suppose I could have typed something wrong. A guy over there says he couldn't login as the user under which the app is supposed to run...but worse what he did is then start the app up under an administrator account. That's just great. Now if their was a hack in my app the hackers had admin access all day before I realized what he did.
One of the major changes I made and one of the things I had to hassle them to do is set apps up under accounts with limiting restrictions - right out of the gate on a clean install he completely reverses this. Even after I stated multiple times to run this under the limited account.
I'm sure this was an inadvertent error by this user, not intentional, but it is hurting my business. I don't blame this person - his company for not training him correctly after the fiasco I just went through and the fact that their higher level tech stated he was annoyed that no one told me to run this app under lower level permissions. So why didn't someone inform the people who do the day to day support?
Next they deleted an administrator account I created. The reason I created a separate one with a separate password is because this company has the password to the main administrator, so someone could login while I was logged in and the log entries would look like I was doing it. Creating a separate login they can't use prevents this.
Additionally, someone opened up remote access for DCOM to all users. I triple checked this was off yesterday. So why couldn't they only give access to the specific app or user that needs it instead of everyone? And I told them to call me before making any of these changes. They didn't.
The whole rebuild was caused by over three months of security issues (see my previous articles for the gory details).
Not even 24 hours after this reinstall my hosting company support staff opened up various security holes on the system. Maybe they were inadvertent, new untrained staff, or whatever but it is my server and my business that is hurt by their "minor" or "not so minor" lapses. They can say they are sorry. I lose time and money.
Here's what happened.
First I think their system for tracking passwords isn't working, but I suppose I could have typed something wrong. A guy over there says he couldn't login as the user under which the app is supposed to run...but worse what he did is then start the app up under an administrator account. That's just great. Now if their was a hack in my app the hackers had admin access all day before I realized what he did.
One of the major changes I made and one of the things I had to hassle them to do is set apps up under accounts with limiting restrictions - right out of the gate on a clean install he completely reverses this. Even after I stated multiple times to run this under the limited account.
I'm sure this was an inadvertent error by this user, not intentional, but it is hurting my business. I don't blame this person - his company for not training him correctly after the fiasco I just went through and the fact that their higher level tech stated he was annoyed that no one told me to run this app under lower level permissions. So why didn't someone inform the people who do the day to day support?
Next they deleted an administrator account I created. The reason I created a separate one with a separate password is because this company has the password to the main administrator, so someone could login while I was logged in and the log entries would look like I was doing it. Creating a separate login they can't use prevents this.
Additionally, someone opened up remote access for DCOM to all users. I triple checked this was off yesterday. So why couldn't they only give access to the specific app or user that needs it instead of everyone? And I told them to call me before making any of these changes. They didn't.
Wednesday, July 12, 2006
Windows File Integrity Checker
Found what I was wishing for tonight. Microsoft has a scan tool that verifies Windows files here:
Windows System File Checker
It looks like this posting is from 2004, however and I have seen reports of this rolling back hotfixes so if you run it make sure you re-run microsoft update.
Windows System File Checker
It looks like this posting is from 2004, however and I have seen reports of this rolling back hotfixes so if you run it make sure you re-run microsoft update.
Configuration Changed by Managed Hosting Company? Again
Interesting, I reported about a DCOM issue last night. Today I logged into my server and the settings were completely changed from the way I had them last night. They look more secure so that's fine, but the Anonymous account has been completely removed and some other user accounts that were in there have been changed. Hmm.
Could this be the work of a hacker or is it an insider at my managed hosting company? Or a conspiracy? Ahh...the imagination goes wild. Need to write a book.
Could this be the work of a hacker or is it an insider at my managed hosting company? Or a conspiracy? Ahh...the imagination goes wild. Need to write a book.
Friday, July 07, 2006
SOA - Rogue Services
Here's an article about rogue services and SOA. There are numerous security issues to consider when software is developed as a service to run accross networks. This article talks about governance and other issues in taming the SOA security beast.
Software Validation - Microsoft Windows
It would be nice if Microsoft would create a tool that runs through your operating system and verifies that all the components are valid.
For instance recently a server was hosed and they ultimately had to replace the TCP/IP software. Was it hacked? Corrupted? Registry problem?
They could turn on the server but could not connect to the firewall. In this case it would be neat to have a nifty tool to run over the machine to verify all the networking components. It should list everything that is not "standard" Microsoft and mention that if you did not change this on purpose - it's probably a hack.
It would also be nice to have a record of which programs, when installed, have altered Microsoft base components to help track down problems.
For instance recently a server was hosed and they ultimately had to replace the TCP/IP software. Was it hacked? Corrupted? Registry problem?
They could turn on the server but could not connect to the firewall. In this case it would be neat to have a nifty tool to run over the machine to verify all the networking components. It should list everything that is not "standard" Microsoft and mention that if you did not change this on purpose - it's probably a hack.
It would also be nice to have a record of which programs, when installed, have altered Microsoft base components to help track down problems.
Thursday, July 06, 2006
The latest - Firewall Open to Terminal Services From any IP
That's it. I have had so many problems with my hosting company. Microsoft's number one hosting company has some serious problems. I just went to a random location and tested and my firewall is wide open to any ip for Terminal Services. This is not what I requested. I have a VPN for this purpose. I am paying for it. I pay them all this money and I think I have absolutely no security. I get hacked constantly. My web server was down all day yesterday, and it went down again today for three hours this morning.
When I asked why the monitoring service failed - no explanation. I was told that someone was reading that my web server runs on port 1100. WHAT? I don't know where in creation they got that information. Not at all accurate. It's running web sites. Don't you think a web site support person would know that web sites run on port 80? Sure you can run them on something else but if you do no one can see them if they don't type in the port number!
Does anyone else see a problem here after reading my posts? Well I'm not going to slam my hosting company just yet. Let's see if they can actually figure out who is doing these things - an internal person - or a hacker. One last chance.
When I asked why the monitoring service failed - no explanation. I was told that someone was reading that my web server runs on port 1100. WHAT? I don't know where in creation they got that information. Not at all accurate. It's running web sites. Don't you think a web site support person would know that web sites run on port 80? Sure you can run them on something else but if you do no one can see them if they don't type in the port number!
Does anyone else see a problem here after reading my posts? Well I'm not going to slam my hosting company just yet. Let's see if they can actually figure out who is doing these things - an internal person - or a hacker. One last chance.
Port 25: CHECK IT!
Ok would everyone out there do me a favor who is running imail on Windows - or at a managed hosting company...
Please set up your firewall logs to use some sort of logging such as Kiwi or some other firewall logging utility that allows you to monitor ALL traffic in and out of your server. Look extraneous traffic on port 25. Check not only the IPs assigned to your server but also your back up servers and database servers. Check your internal and external IPs for this traffic.
If you are at a hosting company, you can ask them to check for this traffic. If they find something it could speed up your web sites and improve performance.
Please also check for multiple copies of extraneous DLLs in your registry like hunny-mime.dll and Cypress.dll. It could be somethine else.
Shut down extraneous services that are running as dllhost.exe in your Windows services panel. Try to figure out what they are and where the came from and report the problem so other people can be alerted to the issue such as companies like Microsoft, RackSpace, McAfee, Norton, etc. to try to resolve the problem at a higher level.
If damage has been done to your business or applications due to this issue report it to the FBI, Secret Service, etc. so it can be investigated.
I am guessing this problem is going on at servers all across the country and probably linked back to certain sources. If those sources can be eliminated OUR Internet will run faster.
Please set up your firewall logs to use some sort of logging such as Kiwi or some other firewall logging utility that allows you to monitor ALL traffic in and out of your server. Look extraneous traffic on port 25. Check not only the IPs assigned to your server but also your back up servers and database servers. Check your internal and external IPs for this traffic.
If you are at a hosting company, you can ask them to check for this traffic. If they find something it could speed up your web sites and improve performance.
Please also check for multiple copies of extraneous DLLs in your registry like hunny-mime.dll and Cypress.dll. It could be somethine else.
Shut down extraneous services that are running as dllhost.exe in your Windows services panel. Try to figure out what they are and where the came from and report the problem so other people can be alerted to the issue such as companies like Microsoft, RackSpace, McAfee, Norton, etc. to try to resolve the problem at a higher level.
If damage has been done to your business or applications due to this issue report it to the FBI, Secret Service, etc. so it can be investigated.
I am guessing this problem is going on at servers all across the country and probably linked back to certain sources. If those sources can be eliminated OUR Internet will run faster.
Tuesday, July 04, 2006
Imail hacks
Found another imail hack today. Somehow my imail IP address for the primary host was listed on an ip that is not on my box, or so I thought. Later one of the techs told me it is on my box and that it is a backup ip and that IP would probably have gotten selected when I installed the latest version of Imail. So, I uninstalled and reinstalled Imail and doesn't seem like this was the case. Actually it looked like there may have been a secondary or virtual host set up and pointing to this IP. I don't see how that could have gotten there in the manner the tech was suggesting. (Microsoft's #1 managed hosting company and they support imail so you'd think they would be up on this kind of thing).
Saturday, July 01, 2006
Undetectable Malware
This is scary- undetectable malware:
Undetectable Malware
So what can the OS manufacturers do about this? As mentioned many times previously - better logging of system and application activities so you can turn on auditing and track every single action taken by the system and query it to pinpoint specific activities and which user accounts or processes are performing those activities.
Also as noted in previous posts - Microsoft's current design for DCOM and RPC makes this pretty much impossible. Some changes are needed to those as well as the underlying system.
To be really nice there could be a way to turn on and off this logging to improve system performance, and a very tight tracking mechanism for WHEN it is turned on and off.
This would render undetectable malware...a bit more detectable.
Undetectable Malware
So what can the OS manufacturers do about this? As mentioned many times previously - better logging of system and application activities so you can turn on auditing and track every single action taken by the system and query it to pinpoint specific activities and which user accounts or processes are performing those activities.
Also as noted in previous posts - Microsoft's current design for DCOM and RPC makes this pretty much impossible. Some changes are needed to those as well as the underlying system.
To be really nice there could be a way to turn on and off this logging to improve system performance, and a very tight tracking mechanism for WHEN it is turned on and off.
This would render undetectable malware...a bit more detectable.
Cisco Software Exploit
Well Cisco has an exploit in some software which I will not go into detail about as I do not want to post information to help the hackers who are obviously reading my blog. [I know this after posting a bait to get them to hack a particular site and they bit.]
But Cisco still has a serious issue. They sent us a fix to some client software and tell us OK have everyone update the client software. Now what the heck good does that do? All some hacker has to do is get a copy of the OLD client software and then they can access my Cisco equipment in an insecure way. What they need to do is fix the SERVER side and disallow the old version of the client software.
But Cisco still has a serious issue. They sent us a fix to some client software and tell us OK have everyone update the client software. Now what the heck good does that do? All some hacker has to do is get a copy of the OLD client software and then they can access my Cisco equipment in an insecure way. What they need to do is fix the SERVER side and disallow the old version of the client software.
Tuesday, June 27, 2006
AppleWebKit - Exploit
This is not good:
DR001 : AppleWebKit XMLHttpRequest arbitrary file disclosure vulnerability
Discovered 2005-02-13
Published 2005-04-16
Discoverer David Remahl
CVE IDs CAN-2005-0976
XMLHttpRequest is a JavaScript component that allows scripts to perform http queries and read their result. The attack described herein requires that the attacker has the ability to place an HTML file on the victim's system and predict its path. By exploiting AppleWebKit's special treatment of XMLHttpRequest when running from a file: document, the attacker can gain read access to any file on the system with a known path that the user running the browser has access to.
Apple WebKit
DR001 : AppleWebKit XMLHttpRequest arbitrary file disclosure vulnerability
Discovered 2005-02-13
Published 2005-04-16
Discoverer David Remahl
CVE IDs CAN-2005-0976
XMLHttpRequest is a JavaScript component that allows scripts to perform http queries and read their result. The attack described herein requires that the attacker has the ability to place an HTML file on the victim's system and predict its path. By exploiting AppleWebKit's special treatment of XMLHttpRequest when running from a file: document, the attacker can gain read access to any file on the system with a known path that the user running the browser has access to.
Apple WebKit
Monday, June 26, 2006
SSL Server - Weak Encryption Vulnerability
You may want to ensure that your server is configured to disallow weak encryption. The Secure Socket Layer (SSL) protocol allows for secure communication between a client and a server. The consequenses of allowing low encryption suppor may allow an attacker to exploit this vulnerability to decrypt secure communications without authorization.
SSL encryption ciphers are classified based on encryption key length:
HIGH - key length larger than 128 bits
MEDIUM - key length equal to 128 bits
LOW - key length smaller than 128 bits
Commercial SSL servers should only support MEDIUM or HIGH strength ciphers to guarantee transaction security. Messages encrypted with LOW encryption ciphers are easy to decrypt.
Although weak cipher support may be available at the SSL layer. Some servers may implement additional protection at the data layer. For example, some SSL servers and SSL proxies (such as SSL accelerators) allow cipher negotiation to complete but send back an error message and abort further communication on the secure channel. This
vulnerability may not be exploitable for such configurations.
Here's how to disable low encryption ciphers on some common web servers:
Apache
Typically, for Apache/mod_ssl, httpd.conf or ssl.conf should have the
following lines:
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
For Apache/apache_ssl include the following line in the configuration file
(httpsd.conf):
SSLRequireCipher ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
Tomcat
sslProtocol="SSLv3" ciphers="SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA"
SSL encryption ciphers are classified based on encryption key length:
HIGH - key length larger than 128 bits
MEDIUM - key length equal to 128 bits
LOW - key length smaller than 128 bits
Commercial SSL servers should only support MEDIUM or HIGH strength ciphers to guarantee transaction security. Messages encrypted with LOW encryption ciphers are easy to decrypt.
Although weak cipher support may be available at the SSL layer. Some servers may implement additional protection at the data layer. For example, some SSL servers and SSL proxies (such as SSL accelerators) allow cipher negotiation to complete but send back an error message and abort further communication on the secure channel. This
vulnerability may not be exploitable for such configurations.
Here's how to disable low encryption ciphers on some common web servers:
Apache
Typically, for Apache/mod_ssl, httpd.conf or ssl.conf should have the
following lines:
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
For Apache/apache_ssl include the following line in the configuration file
(httpsd.conf):
SSLRequireCipher ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
Tomcat
sslProtocol="SSLv3" ciphers="SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA"
Web Sense
Isn't it nice of Web Sense to check out the app that I've been having all the security problems with - what my whole blog is about? Web Sense is some sort of security monitoring service I guess. You can check out their web site:
Web Sense
But wait, how is it that they are going straight to a result page, with no referrer? That would pretty much mean that they are posting data straight to my page from their location or some invalid source page...wouldn't it? And why are requests coming from different machines with different operating systems? Perhaps some kind of proxy.
And why would they be looking at the site at 2 a.m.?
Web Sense
But wait, how is it that they are going straight to a result page, with no referrer? That would pretty much mean that they are posting data straight to my page from their location or some invalid source page...wouldn't it? And why are requests coming from different machines with different operating systems? Perhaps some kind of proxy.
And why would they be looking at the site at 2 a.m.?
winhttp autoproxy service - Security Issue?
When I changed an app to run under a non-windows administrator account (as it should have been in the first place but that was explained two posts ago) someone was somehow trying to start the winhttp autoproxy service about 15 times. The only thing running under this user name was my web app. Therefore I must assume someone has hacked my application somehow and was trying to fire up the service.
I am using Jboss and about to switch to another platform because I am nervous about so many functions in Jboss that it actually creats a myriad of security holes. Because I have written an optimized application I don't need all that functionality and will opt for a lighter application to serve up the pages.
Aha! You say - but it could be a cross site scripting attack and that will affect you no matter what web server you are using. True, but my whole application and all forms run on one underlying form processing functionality and all database calls are checked to be sql safe in this process.
True I could have missed something and I already have further enhancements planned, but the less convoluted-ness you have on your system and the less "things" running the less chance for a security breach. You just eliminate additional possiblities.
I feel a new post coming on related to system convolusion (is that a word?) ...stay tuned...
I am using Jboss and about to switch to another platform because I am nervous about so many functions in Jboss that it actually creats a myriad of security holes. Because I have written an optimized application I don't need all that functionality and will opt for a lighter application to serve up the pages.
Aha! You say - but it could be a cross site scripting attack and that will affect you no matter what web server you are using. True, but my whole application and all forms run on one underlying form processing functionality and all database calls are checked to be sql safe in this process.
True I could have missed something and I already have further enhancements planned, but the less convoluted-ness you have on your system and the less "things" running the less chance for a security breach. You just eliminate additional possiblities.
I feel a new post coming on related to system convolusion (is that a word?) ...stay tuned...
Sunday, June 25, 2006
www.whois.sc - publishing your system info
Take a look at domains in www.whois.sc and you will find that they not only publish information about the site, but also the OS on which the site is running, the web server, version numbers - everything. It doesn't seem to me that they should be publishing this information without explicit permission from the web site owners. Once someone knows what operating system you run and the software you are running on it they are able to eliminate a great deal of work in the number of exploits they have to try to get a result. They can go for blood out of the gate for holes in those known types of software.
Oh and by the way now your system information is searchable, making it easier for hackers to find all the sites that run PHP for instance...
If I were you, I would recommend that you request removal from this database:
Hacker Info
Of course they provide no way to contact them on their web site without creating an account. Isn't that lovely. Therefore I looked up the DNS records and drilled down first using the whois on DNSStuff.com which led me to this address:
hostmaster@ascern.com
However if you look up the domain name records using the DNS Lookup Tool on the right side of the screen you get:
cluster.nameintel.com. A IN 300 66.249.4.251
nameintel.com. NS IN 86400 ns1.dnscloud.com.
nameintel.com. NS IN 86400 ns2.dnscloud.com.
ns1.dnscloud.com. A IN 3600 209.59.193.17
ns2.dnscloud.com. A IN 3600 64.246.165.245
The contact for this particular set of domain records is:
Domain name: NAMEINTEL.COM
Registrant, Administrative, Technical Contact:
Name Intelligence, Inc.
12806 SE 22nd PL
Bellevue, WA 98005
By phone: 206-838-9035
By email: port43@nameintel.com
Status: Registrar-Lock
Name Servers:
ns1.dnscloud.com
ns2.dnscloud.com
You can also contact the higher level network that supports them here:
Fiber Cloud
Hmm I wonder if they like this being published?
Oh and by the way now your system information is searchable, making it easier for hackers to find all the sites that run PHP for instance...
If I were you, I would recommend that you request removal from this database:
Hacker Info
Of course they provide no way to contact them on their web site without creating an account. Isn't that lovely. Therefore I looked up the DNS records and drilled down first using the whois on DNSStuff.com which led me to this address:
hostmaster@ascern.com
However if you look up the domain name records using the DNS Lookup Tool on the right side of the screen you get:
cluster.nameintel.com. A IN 300 66.249.4.251
nameintel.com. NS IN 86400 ns1.dnscloud.com.
nameintel.com. NS IN 86400 ns2.dnscloud.com.
ns1.dnscloud.com. A IN 3600 209.59.193.17
ns2.dnscloud.com. A IN 3600 64.246.165.245
The contact for this particular set of domain records is:
Domain name: NAMEINTEL.COM
Registrant, Administrative, Technical Contact:
Name Intelligence, Inc.
12806 SE 22nd PL
Bellevue, WA 98005
By phone: 206-838-9035
By email: port43@nameintel.com
Status: Registrar-Lock
Name Servers:
ns1.dnscloud.com
ns2.dnscloud.com
You can also contact the higher level network that supports them here:
Fiber Cloud
Hmm I wonder if they like this being published?
Security Tools
My hosting company just informed me that Sysinternals.com is a good and trusted source for security tools. Of course you must validate everything you download and run it first in test environment before production, but they seem to think this is a trusted source. Visit the web site for more information on Security Tools.
Top 10 code security tips - from Microsoft
Microsoft published the following top 10 list for secure code including authenticating user input, preventing cross site scripting, buffer overruns and sql injection attacks. Web Application Code Security Tips
Sending Spam Complaints - Foreign Languages
Here's a page that tells how to send spam / abuse complaints in foreign languages - including China - as they say.
Sending Spam Complaints - Foreign Languages
I have no idea if these are legitimate...
Sending Spam Complaints - Foreign Languages
I have no idea if these are legitimate...
Qualys - Vulnerability Management
Here is a company that offers protection for e-commerce infrastructure. They offer a Free 14 Day trial of their Vulnerability Management Tool. They are working with some big name e-commerce companies.
Thursday, June 22, 2006
Strong Authentication - Secure Application Login
Here's an article on various types of secure login procedures. Interestingly enough the article ends with information on the time it takes help desks to retrieve lost passwords. Yes, security has a price. That point has been brought up many times in previous posts.
Password Security
Password Security
Tuesday, June 20, 2006
Security Scan for a Windows Server: Microsoft Baseline Security Analyzer
Run Microsoft Baseline Security Analyzer on your machine to find things that may be insecure on a Windows Server:
Secure Windows Server
Secure Windows Server
Sunday, June 11, 2006
Is your OS Detectable by Hackers?
You may want to check this out to make sure your OS is not detectable by hackers. Being able to detect the operating system...one step closer to knowing what hacks to try...
OS Fingerprinting
OS Fingerprinting
Saturday, June 10, 2006
Hacking by SQL Injection
Similar to cross site scripting (seem my previous post on the topic) web site owners should be aware of sql injection attacks which are very similar. The attacker inserts sql code into a text box on a web site in order to insert and remove information from a database. Additionally a hacker could actually obtain control over the machine and execute other actions as well.
Here's a good article on the subject:
sql injection
Here's a good article on the subject:
sql injection
Friday, June 09, 2006
How Google Can Help Stop Hackers
I just read this article about how Google helps hackers:
Google Helps Hackers
Instead of providing a mechanism to HELP hackers Google could actually help stop hackers by maintaining a list of such hacks and reporting the issue to server owners when possible. For instance instead of allowing these known hacks to get into the Google search results and cache, Google could have an automatic way to look up the domain owner and send a friendly email to those (who wish to get them) to alert them to a potential problem on their network.
Google Helps Hackers
Instead of providing a mechanism to HELP hackers Google could actually help stop hackers by maintaining a list of such hacks and reporting the issue to server owners when possible. For instance instead of allowing these known hacks to get into the Google search results and cache, Google could have an automatic way to look up the domain owner and send a friendly email to those (who wish to get them) to alert them to a potential problem on their network.
Tuesday, May 30, 2006
Cross Site Scripting - Hijacked Web Sites
I found a very good article on cross site scripting. This particular type of hack is very disconcerting because someone could basically take over your site and redirect users elsewhere, steal passwords and data.
cross site scripting
This article brings up a few side issues to consider in relation to security:
I choose never to store passwords in my browser. You have that option but this is an obvious major focus of hackers looking for your bill paying, email and banking site logins. A cross site scripting attack according to this article could allow hackers to get at this data.
PHP and other scripting languages are subject to these type of attacks and have certain vulnerabilities inherent in the way they work. Client side scripting is great but make sure everything is double checked server side. Script by it's very nature has less validation than typical server side languages. Check your work!
Preventing Cross Site Scripting
Two things to prevent server side scripting: Validate every single form entry on your web site. You can either reject invalid data, or parse out any HTML characters such as < and " and replace them with the values such as < and " This renders previously executable code meaningless.
Finally, the whole issue with checking referring pages as mentioned in previous posts. Make sure the referrers and pages coming to you are what you expect by checking them on critical forms such as login and e-commerce checkout pages. This doesn't do much good if your form has been referred away to another server but can check when information is coming into your server to ensure it's coming from the source you expect.
cross site scripting
This article brings up a few side issues to consider in relation to security:
I choose never to store passwords in my browser. You have that option but this is an obvious major focus of hackers looking for your bill paying, email and banking site logins. A cross site scripting attack according to this article could allow hackers to get at this data.
PHP and other scripting languages are subject to these type of attacks and have certain vulnerabilities inherent in the way they work. Client side scripting is great but make sure everything is double checked server side. Script by it's very nature has less validation than typical server side languages. Check your work!
Preventing Cross Site Scripting
Two things to prevent server side scripting: Validate every single form entry on your web site. You can either reject invalid data, or parse out any HTML characters such as < and " and replace them with the values such as < and " This renders previously executable code meaningless.
Finally, the whole issue with checking referring pages as mentioned in previous posts. Make sure the referrers and pages coming to you are what you expect by checking them on critical forms such as login and e-commerce checkout pages. This doesn't do much good if your form has been referred away to another server but can check when information is coming into your server to ensure it's coming from the source you expect.
Tuesday, May 16, 2006
Password Encryption & Security
I just wanted to give a plug to this article which provides a very good overview of some important aspects of software application security:
How Developers Can Help Protect Application Data
I've been reviewing various encryption and security mechanisms. Of interest is the debate between storing an MD5 Hash in the database versus encrypting passwords by some other means.
The basic gist of the discussion is that by using encryption you have to have a key and that key, if stolen, can be used by a hacker to figure out your passwords and login to your applications. Worse yet, people tend to use the same passwords across different systems on the Internet. A hacker could gain access to the email address and password and attempt to log in at banking sites and other critical systems to steal user information. For this reason I personally use separate passwords for different types of applications with different levels of critical data on the net.
A potentially safer mechanism would be to use an MD5 or SHA hash with random "salt" or "seed" to generate the digest. Then store the results which will be a meaningless piece of data in the database which can never be decrypted, but can be used for comparison when logging into a system to make sure the user name and password match. This would not work if the password ever needs to be retrieved for some reason, but in general it would probably be better to just reset the password if lost, rather than send it back to someone in an email which is highly insecure. Of note, I have read reports that MD5 can be subject to brute force attacks and SHA, in general seems to be a better choice per word on the street, however I also read a post that theoretically SHA has been cracked in a lab setting. Still, any encryption is better than none as it makes it one step harder to access the data.
Encrypting passwords in databases is only one piece of the puzzle however. Even if encrypted a hacker could obtain the encrypted version of the password or hash and log into the application which is using that particular encrypted or hashed password. Therefore it is also important to protect the data as it passes between the web browser and the server, as another at least basic means of securing the data. Using an SSL certificate and communicating via https instead of http when passing data back and forth between the browser and server ensures that someone cannot access the data in transit and use it to login. If they do that data will be encrypted so they will not be able to obtain the hashed value.
I have seen the argument that someone could build their own code somewhere and host it to login to a web application. In other words, your site has a page on it with a login form that, when submitted, calls code to generate a hash and compare the login against the hash in the database and login. Someone else, if they had the hash, could create a way to submit the straight hash to the database in theory and login even if they don't know the password. Well assuming you have protected your server(s) so the hacker cannot upload executable files you could put a mechanism of verifying the referrer to your login code is coming from the correct source. I have not looked into the possibility of altering the referrer in the header being passed in but at least it adds one more level of protection and I am sure there is a mechanism for further verifying this information.
One other security mechanism to consider is forcing users to create strong passwords and creating validation mechanisms both when entering new passwords and when logging in. Additionally in the case of a hacker trying to hit a login form with random values until they obtain a password you could put in some sort of verification that it is a real user such as forcing the person logging in to enter a series of random numbers or letters generated on the screen in a graphic (which cannot be screen scraped like html text and hard to parse by an automated mechanism).
Hopefully this will steer some software developers in the right direction when attempting to encrypt passwords and implement application security.
How Developers Can Help Protect Application Data
I've been reviewing various encryption and security mechanisms. Of interest is the debate between storing an MD5 Hash in the database versus encrypting passwords by some other means.
The basic gist of the discussion is that by using encryption you have to have a key and that key, if stolen, can be used by a hacker to figure out your passwords and login to your applications. Worse yet, people tend to use the same passwords across different systems on the Internet. A hacker could gain access to the email address and password and attempt to log in at banking sites and other critical systems to steal user information. For this reason I personally use separate passwords for different types of applications with different levels of critical data on the net.
A potentially safer mechanism would be to use an MD5 or SHA hash with random "salt" or "seed" to generate the digest. Then store the results which will be a meaningless piece of data in the database which can never be decrypted, but can be used for comparison when logging into a system to make sure the user name and password match. This would not work if the password ever needs to be retrieved for some reason, but in general it would probably be better to just reset the password if lost, rather than send it back to someone in an email which is highly insecure. Of note, I have read reports that MD5 can be subject to brute force attacks and SHA, in general seems to be a better choice per word on the street, however I also read a post that theoretically SHA has been cracked in a lab setting. Still, any encryption is better than none as it makes it one step harder to access the data.
Encrypting passwords in databases is only one piece of the puzzle however. Even if encrypted a hacker could obtain the encrypted version of the password or hash and log into the application which is using that particular encrypted or hashed password. Therefore it is also important to protect the data as it passes between the web browser and the server, as another at least basic means of securing the data. Using an SSL certificate and communicating via https instead of http when passing data back and forth between the browser and server ensures that someone cannot access the data in transit and use it to login. If they do that data will be encrypted so they will not be able to obtain the hashed value.
I have seen the argument that someone could build their own code somewhere and host it to login to a web application. In other words, your site has a page on it with a login form that, when submitted, calls code to generate a hash and compare the login against the hash in the database and login. Someone else, if they had the hash, could create a way to submit the straight hash to the database in theory and login even if they don't know the password. Well assuming you have protected your server(s) so the hacker cannot upload executable files you could put a mechanism of verifying the referrer to your login code is coming from the correct source. I have not looked into the possibility of altering the referrer in the header being passed in but at least it adds one more level of protection and I am sure there is a mechanism for further verifying this information.
One other security mechanism to consider is forcing users to create strong passwords and creating validation mechanisms both when entering new passwords and when logging in. Additionally in the case of a hacker trying to hit a login form with random values until they obtain a password you could put in some sort of verification that it is a real user such as forcing the person logging in to enter a series of random numbers or letters generated on the screen in a graphic (which cannot be screen scraped like html text and hard to parse by an automated mechanism).
Hopefully this will steer some software developers in the right direction when attempting to encrypt passwords and implement application security.
Thursday, May 11, 2006
Fighting Internet Crime
Here is an interesting article on Cyber-Crime. I have long been arguing that IT people should not throw up their hands at spammers and hackers and continue to block them out - but fight them! Report them! Get them off the net!
Everyone is so apathetic it's no wonder the problem only gets worse. There is something you can do.
Read this article:
Fight Internet Crime
Everyone is so apathetic it's no wonder the problem only gets worse. There is something you can do.
Read this article:
Fight Internet Crime
Thursday, May 04, 2006
Why Analyze Firewall Logs?
I don't know how many times I've heard network admins to say something to the effect of "Don't waste your time looking at firewall logs". Sure I can ignore it like everyone else and sometimes I have to - because I have to get other work done. But here is one of the benefits of analyzing your firewall logs periodically.
When I first reviewed the logs there were about 26,000 hits in one day. I went through the ports and errors and found some mail problems - DNS records that were missing MX records, and a newsletter that wasn't allowing bounces through. I was able to reduce that down to about 1000 per day.
By further analyzing the logs and blocking out Asian hacker ips and reporting hackers to networks for a couple of days, I was able to get that down to about 450.
Here's our China Hacker Database - also Taiwan, Korea, etc..
Maybe if I used one of those automated programs and had more time I could get that down even further. I did notice however that the automated program mentioned in this blog only sends a report abuse after a certain threshold is reached and that is probably why a lot of hackers are sending one line at a time. So sometimes further analysis is needed even in the case where you have an automated program helping you out.
So how are hacker wanna bes reported? Go to your firewall log, cut and paste the lines with time, date, incoming ip and port, outgoing ip and port. Paste it in an email. Copy the incoming IP and go over to DNSSTuff.com and look it up. Copy the abuse email and send it out. Of course this only works for low volume situations, but if everyone started doing this the networks would have patterns to track down abuses from multiple people.
That's my take on why analyzing your firewall logs periodically is a good idea!
When I first reviewed the logs there were about 26,000 hits in one day. I went through the ports and errors and found some mail problems - DNS records that were missing MX records, and a newsletter that wasn't allowing bounces through. I was able to reduce that down to about 1000 per day.
By further analyzing the logs and blocking out Asian hacker ips and reporting hackers to networks for a couple of days, I was able to get that down to about 450.
Here's our China Hacker Database - also Taiwan, Korea, etc..
Maybe if I used one of those automated programs and had more time I could get that down even further. I did notice however that the automated program mentioned in this blog only sends a report abuse after a certain threshold is reached and that is probably why a lot of hackers are sending one line at a time. So sometimes further analysis is needed even in the case where you have an automated program helping you out.
So how are hacker wanna bes reported? Go to your firewall log, cut and paste the lines with time, date, incoming ip and port, outgoing ip and port. Paste it in an email. Copy the incoming IP and go over to DNSSTuff.com and look it up. Copy the abuse email and send it out. Of course this only works for low volume situations, but if everyone started doing this the networks would have patterns to track down abuses from multiple people.
That's my take on why analyzing your firewall logs periodically is a good idea!
Sunday, April 30, 2006
NetWatchman
Here's a cool thing if they are legit. My big beef about network admins, managed firewalls, and network security is that it is impossible to track, monitor and report problems in a way that actually makes a difference. (See my managed shmanaged firewall post).
These guys are actually giving it a go. Good for them!
MyNetWatchman.com
It looks pretty cool (if it works) because they monitor the traffic and after so many attemps they automatically notify the offending network, and if someone at the offending network actually looks into the problem some of these holes on the Internet can be plugged up.
Better yet would be if the offending networks actually report the criminal if they can find him/her to the FBI.
Of course someone still needs to verify that they are actually sending the complete log and not actually hacking and altering logs as the information is reported just as in my post about McAfee firewall possibly having problems.
The concept, however, is very cool and hopefully will help notify networks with servers that need to be patched up quickly if a lot of people start using it, or something like it.
These guys are actually giving it a go. Good for them!
MyNetWatchman.com
It looks pretty cool (if it works) because they monitor the traffic and after so many attemps they automatically notify the offending network, and if someone at the offending network actually looks into the problem some of these holes on the Internet can be plugged up.
Better yet would be if the offending networks actually report the criminal if they can find him/her to the FBI.
Of course someone still needs to verify that they are actually sending the complete log and not actually hacking and altering logs as the information is reported just as in my post about McAfee firewall possibly having problems.
The concept, however, is very cool and hopefully will help notify networks with servers that need to be patched up quickly if a lot of people start using it, or something like it.
International IP Database
I've been looking for this for quite some time and telling investors that we need it. Finally I found it...
International IP Database
Now you might think, hey, I can already get this information from DNSSTuff.com or any of the Internet databases out there. Why do I need this?
Here's why: Because organizations like RIPE span multiple countries and the IPs are not kept together in blocks for each country. You could have an Australian net range of DNS records butted up against the infamous Chinese hacker net ranges.
Well, it's pretty well established that there are loads of hackers coming out of Taiwan, Korea, China, Russia and a few in Japan. So let's say you have no reason to do business with Asia and you want to just block out that whole set of IPs to prevent any unwanted attacks from those countries but still allow you to do business with other coutries whose DNS is supported by the RIPE DNS database. How are you going to do that? Impossible!
Until now. If this Maxmind.com database really works - I say if because I have not verified that it is accurate, or that they are a legitimate, non-hacker organization and that their information has not been hacked - then you should be able to use their database to update your firewall and simply block out these problem countries laden with hackers.
As noted in other reports China is actually leveraging hackers in their country as an espiange and internet warfare force. It may be best to just completely block them out if you don't have a need to do business with them, or have separate servers for Asia and other parts of the world. This is an extreme suggestion, but this is the world we live in and hackers abound in certain countries.
True hackers could re-route through other countries but it would make it one step harder for them and hopefully these other countries would be more hacker UNfriendly.
International IP Database
Now you might think, hey, I can already get this information from DNSSTuff.com or any of the Internet databases out there. Why do I need this?
Here's why: Because organizations like RIPE span multiple countries and the IPs are not kept together in blocks for each country. You could have an Australian net range of DNS records butted up against the infamous Chinese hacker net ranges.
Well, it's pretty well established that there are loads of hackers coming out of Taiwan, Korea, China, Russia and a few in Japan. So let's say you have no reason to do business with Asia and you want to just block out that whole set of IPs to prevent any unwanted attacks from those countries but still allow you to do business with other coutries whose DNS is supported by the RIPE DNS database. How are you going to do that? Impossible!
Until now. If this Maxmind.com database really works - I say if because I have not verified that it is accurate, or that they are a legitimate, non-hacker organization and that their information has not been hacked - then you should be able to use their database to update your firewall and simply block out these problem countries laden with hackers.
As noted in other reports China is actually leveraging hackers in their country as an espiange and internet warfare force. It may be best to just completely block them out if you don't have a need to do business with them, or have separate servers for Asia and other parts of the world. This is an extreme suggestion, but this is the world we live in and hackers abound in certain countries.
True hackers could re-route through other countries but it would make it one step harder for them and hopefully these other countries would be more hacker UNfriendly.
Saturday, April 29, 2006
The Real Estate Hackers
Real Estate on the net is hot. I know this because I do SEO, advertising and marketing for Real Estate web sites among other things. There are a bunch of hackers targeted on Real Estate. One of them from China was generating a bunch of spam on a lead generating site we had set up for a customer. I recently had a customer that I am not convinced was not part of this real estate crime ring. Yes, hacking and spamming is a CRIME in case you real estate people who are doing this like to think otherwise - that maybe it is just tough business. It is not. I hope you like to wear stripes, or orange jumpsuits as it may be these days.
208.8.186.35
Location: United States [City: Honolulu, Hawaii]
Sprint SPRINTLINK-BLKS (NET-208-0-0-0-1)
208.0.0.0 - 208.35.255.255
Honolulu Board of Realtors SPRINTLINK (NET-208-8-186-0-1)
208.8.186.0 - 208.8.186.255
Location: Unknown
OrgName: Honolulu Board of Realtors
OrgID: HBR-1
Address: 1136 12th Avenue
City: Honolulu
StateProv: HI
PostalCode: 96816
Country: US
Name: Elam, Thomas
Handle: TEL1258-ARIN
Company: Honolulu Board of Realtors
Address: 1136 12th Avenue Ste 200
City: Honolulu
StateProv: HI
PostalCode: 96816
Country: US
____________
69.233.224.3
SBC Internet Services SBCIS-SIS80 (NET-69-224-0-0-1)
69.224.0.0 - 69.239.255.255
Heritage Plaza Mortgage SBC06923322400025041116172757 (NET-69-233-224-0-1)
69.233.224.0 - 69.233.224.127
CustName: Heritage Plaza Mortgage
Address: Private Address
City: San Francisco
StateProv: CA
PostalCode: 94107
Country: US
RegDate: 2004-11-16
Updated: 2004-11-16
NetRange: 69.233.224.0 - 69.233.224.127
CIDR: 69.233.224.0/25
NetName: SBC06923322400025041116172757
NetHandle: NET-69-233-224-0-1
Parent: NET-69-224-0-0-1
OrgName: Office of the Future
OrgID: OFFICE
Address: 115 River Rd
City: Edgewater
StateProv: NJ
PostalCode: 02020
Country: US
Comment:
RegDate: 1992-09-10
Updated: 1992-09-10
69.233.224.3
____________
CustName: Heritage Plaza Mortgage
Address: Private Address
City: San Francisco
StateProv: CA
PostalCode: 94107
Country: US
RegDate: 2004-11-16
Updated: 2004-11-16
Name: IPAdmin-PBI
Handle: PIA2-ORG-ARIN
Company: Pacific Bell Internet
Address: 268 Bush St. #5000
City: San Francisco
StateProv: CA
PostalCode: 94104
Country: US
OrgName: Office of the Future
OrgID: OFFICE
Address: 115 River Rd
City: Edgewater
StateProv: NJ
PostalCode: 02020
Country: US
208.8.186.35
Location: United States [City: Honolulu, Hawaii]
Sprint SPRINTLINK-BLKS (NET-208-0-0-0-1)
208.0.0.0 - 208.35.255.255
Honolulu Board of Realtors SPRINTLINK (NET-208-8-186-0-1)
208.8.186.0 - 208.8.186.255
Location: Unknown
OrgName: Honolulu Board of Realtors
OrgID: HBR-1
Address: 1136 12th Avenue
City: Honolulu
StateProv: HI
PostalCode: 96816
Country: US
Name: Elam, Thomas
Handle: TEL1258-ARIN
Company: Honolulu Board of Realtors
Address: 1136 12th Avenue Ste 200
City: Honolulu
StateProv: HI
PostalCode: 96816
Country: US
____________
69.233.224.3
SBC Internet Services SBCIS-SIS80 (NET-69-224-0-0-1)
69.224.0.0 - 69.239.255.255
Heritage Plaza Mortgage SBC06923322400025041116172757 (NET-69-233-224-0-1)
69.233.224.0 - 69.233.224.127
CustName: Heritage Plaza Mortgage
Address: Private Address
City: San Francisco
StateProv: CA
PostalCode: 94107
Country: US
RegDate: 2004-11-16
Updated: 2004-11-16
NetRange: 69.233.224.0 - 69.233.224.127
CIDR: 69.233.224.0/25
NetName: SBC06923322400025041116172757
NetHandle: NET-69-233-224-0-1
Parent: NET-69-224-0-0-1
OrgName: Office of the Future
OrgID: OFFICE
Address: 115 River Rd
City: Edgewater
StateProv: NJ
PostalCode: 02020
Country: US
Comment:
RegDate: 1992-09-10
Updated: 1992-09-10
69.233.224.3
____________
CustName: Heritage Plaza Mortgage
Address: Private Address
City: San Francisco
StateProv: CA
PostalCode: 94107
Country: US
RegDate: 2004-11-16
Updated: 2004-11-16
Name: IPAdmin-PBI
Handle: PIA2-ORG-ARIN
Company: Pacific Bell Internet
Address: 268 Bush St. #5000
City: San Francisco
StateProv: CA
PostalCode: 94104
Country: US
OrgName: Office of the Future
OrgID: OFFICE
Address: 115 River Rd
City: Edgewater
StateProv: NJ
PostalCode: 02020
Country: US
Thursday, April 27, 2006
More Hackers
222.239.220.119/7212
218.169.56.56/25
69.20.5.234/1434
88.38.49.26/137
67.15.35.88/80
72.30.98.160/80
72.0.167.169/135
207.118.218.248/25
72.25.91.180/139
211.229.208.202/7212
213.148.236.194 / 137
220.144.197.62 / 445
219.137.124.187 135
61.185.94.21 / 1434
58.253.248.2 / 1434
219.137.124.187/135
204.16.208.74/1027
200.255.218.1/445
59.37.70.21**ssh
83.156.81.66/445
139.18.13.202/80
61.134.60.18 / 1434
inetnum: 61.134.0.0 - 61.134.63.255
netname: CHINANET-SN
72.2.75.137 / 1433
CustName: Suite 224 Internet
Address: P.O. Box 579
Address: 224 State St.
City: Conneaut
StateProv: OH
PostalCode: 44030
Country: US
RegDate: 2005-01-19
Updated: 2005-01-19
NetRange: 72.2.72.0 - 72.2.79.255
218.72.250.229 / 25
inetnum: 218.72.248.0 - 218.72.255.255
netname: CHINANET-ZJ-QZ
country: CN
59.93.194.201 / 137
inetnum: 59.88.0.0 - 59.99.255.255
netname: BSNLNET
descr: NIB (National Internet Backbone)
descr: Bharat Sanchar Nigam Limited
descr: Sanchar Bhawan,20, Ashoka Road, New Delhi-110001
83.60.209.115 / 137
inetnum: 83.57.0.0 - 83.61.24.255
netname: RIMA
descr: TELEFONICA DE ESPANA
descr: Provider Local Registry
country: ES
201.8.133.231 / 137
inetnum: 201.8/16
aut-num: AS7738
abuse-c: CGR13
owner: Telemar Norte Leste S.A.
ownerid: 002.558.134/0001-58
responsible: Marlemar Telgon
address: Rua Humberto de Campos, 425, 7? andar
address: 22430-190 - Rio de Janeiro - RJ
phone: (021) 31311343 []
owner-c: MAT838
tech-c: CGR13
inetrev: 201.8.0/24
82.155.1.112 / 137
inetnum: 82.155.0.0 - 82.155.127.255
netname: TELEPAC-DSL
descr: Telepac - Comunicacoes Interactivas, SA
descr: DSL Service Networks
country: PT
218.71.250.229 / 25
72.2.75.137 / 1433
222.183.72.214 / 1434
66.234.2.61 /320000
67.15.35.2 / 80
218.169.56.56/25
69.20.5.234/1434
88.38.49.26/137
67.15.35.88/80
72.30.98.160/80
72.0.167.169/135
207.118.218.248/25
72.25.91.180/139
211.229.208.202/7212
213.148.236.194 / 137
220.144.197.62 / 445
219.137.124.187 135
61.185.94.21 / 1434
58.253.248.2 / 1434
219.137.124.187/135
204.16.208.74/1027
200.255.218.1/445
59.37.70.21**ssh
83.156.81.66/445
139.18.13.202/80
61.134.60.18 / 1434
inetnum: 61.134.0.0 - 61.134.63.255
netname: CHINANET-SN
72.2.75.137 / 1433
CustName: Suite 224 Internet
Address: P.O. Box 579
Address: 224 State St.
City: Conneaut
StateProv: OH
PostalCode: 44030
Country: US
RegDate: 2005-01-19
Updated: 2005-01-19
NetRange: 72.2.72.0 - 72.2.79.255
218.72.250.229 / 25
inetnum: 218.72.248.0 - 218.72.255.255
netname: CHINANET-ZJ-QZ
country: CN
59.93.194.201 / 137
inetnum: 59.88.0.0 - 59.99.255.255
netname: BSNLNET
descr: NIB (National Internet Backbone)
descr: Bharat Sanchar Nigam Limited
descr: Sanchar Bhawan,20, Ashoka Road, New Delhi-110001
83.60.209.115 / 137
inetnum: 83.57.0.0 - 83.61.24.255
netname: RIMA
descr: TELEFONICA DE ESPANA
descr: Provider Local Registry
country: ES
201.8.133.231 / 137
inetnum: 201.8/16
aut-num: AS7738
abuse-c: CGR13
owner: Telemar Norte Leste S.A.
ownerid: 002.558.134/0001-58
responsible: Marlemar Telgon
address: Rua Humberto de Campos, 425, 7? andar
address: 22430-190 - Rio de Janeiro - RJ
phone: (021) 31311343 []
owner-c: MAT838
tech-c: CGR13
inetrev: 201.8.0/24
82.155.1.112 / 137
inetnum: 82.155.0.0 - 82.155.127.255
netname: TELEPAC-DSL
descr: Telepac - Comunicacoes Interactivas, SA
descr: DSL Service Networks
country: PT
218.71.250.229 / 25
72.2.75.137 / 1433
222.183.72.214 / 1434
66.234.2.61 /320000
67.15.35.2 / 80
Wednesday, April 26, 2006
DNS Spoofing
Here's what you need to know about DNS Spoofing:
http://www.menandmice.com/9000/9211_dns_spoofing.html
And steps to take to secure your DNS Server:
http://www.linuxsecurity.com/resource_files/server_security/securing_an_internet_name_server.pdf
http://www.menandmice.com/9000/9211_dns_spoofing.html
And steps to take to secure your DNS Server:
http://www.linuxsecurity.com/resource_files/server_security/securing_an_internet_name_server.pdf
A related article on DNS hacking
http://news.com.com/DNS+servers+do+hackers+dirty+work/2100-7349_3-6053468.html
Why The US Doesn't Release Control Of DNS Databases
There are a bunch of open source programmers and idealists out there that complain that the US Government is bad because they don't want to release control of the Internet domain name databases. The attitude is that the US is terrible because we don't cooperate with the world...
OK I don't like a closed nation kind of thought process and have many friends in other countries that I communicate with regularly and clients in other countries, but there are some serious security issues related to that DNS database. Basically that database identifies the true (in theory) identities and locations of computer users around the world. It's not that the US is saying "we created it and we're keeping it!" It is a matter of national defense.
For instance let's say we give up these databases to countries that are obviously harboring hackers and spammers or don't particularly like the United States.
Let's say we just hand over control of these databases to these other countries. Now what happens...the logical progression is that the countries that are harboring spammers and hackers change the records. They can point people to alternate IP addresses for domain names that are not legitimate and send back false information for a particular IP range.
The Internet Protocol (IP) was developed by the US Military as a fault tolerant means of sending traffic over the Internet. The reality is that the next form of warfare is information technology.
Having our enemies control our mechanism for communication, if we continue to use the Internet as a source of routing messages when we don't control the routing, is game over.
OK I don't like a closed nation kind of thought process and have many friends in other countries that I communicate with regularly and clients in other countries, but there are some serious security issues related to that DNS database. Basically that database identifies the true (in theory) identities and locations of computer users around the world. It's not that the US is saying "we created it and we're keeping it!" It is a matter of national defense.
For instance let's say we give up these databases to countries that are obviously harboring hackers and spammers or don't particularly like the United States.
Let's say we just hand over control of these databases to these other countries. Now what happens...the logical progression is that the countries that are harboring spammers and hackers change the records. They can point people to alternate IP addresses for domain names that are not legitimate and send back false information for a particular IP range.
The Internet Protocol (IP) was developed by the US Military as a fault tolerant means of sending traffic over the Internet. The reality is that the next form of warfare is information technology.
Having our enemies control our mechanism for communication, if we continue to use the Internet as a source of routing messages when we don't control the routing, is game over.
AOL - Hacker Heaven
Don't you just love AOL? They have some really cool features like multiple email addresses and included firewall and spam blocking, parental controls and a nice content layout. It's easy to use and they have phone numbers all of the world so you can access the system from just about anywhere when you travel...
Yeah it's great for hackers too! The thing about accessing it from anywhere is helpful if you're a spammer or hacker too. The IP address in the logs is the same for all.
AOL provides anonymity for hackers due to the fact that everyone is connecting to the same servers and accessing the Internet and sending messages in a way that is difficult to track back to the actual users. Additionally it is virtually impossible to block because if network admins try to block out the offending IP, they are basically blocking out a whole lot of valid (valuable) traffic from AOL users.
And have you ever tried to figure out how to report an attacker to AOL? Take a look at their web site and just try to figure it out. Impossible...
I have found this article which suggests an address but since it is not official AOL information and Wikipedia lets anyone update the content, who knows if it is accurate or has been hacked? For all we know using this information we could be feeding AOL hackers information that we are onto them and that helps them stay one step ahead:
http://en.wikipedia.org/wiki/Wikipedia:Dealing_with_AOL_vandals
The email listed in here currently to report hackers to AOL is: TOSgeneral@aol.com
If you go to spamcop.net you'll get this abuse email address to report spammers to AOL: abuse@aol.com
Who knows if these emails are valid and your message actually gets to AOL. I have made reports to them with no response, and hackers continue to hit my systems from the same IPS, and the information in McAfee still shows these odd hacker DNS records (more info in my first post on these):
AOL.COM.IS.N0T.AS.1337.AS.GULLI.COM
AOL.COM.IS.0WNED.BY.SUB7.NET
AOL.COM.AINT.GOT.AS.MUCH.FREE.PORN.AS.SECZ.COM
AOL.COM
Interestingly an IP attempting to access my box right has high level domain information which does not match the typical information I see for AOL.
The IP is: 64.12.116.197
The information listed for AOL is:
Address: 10600 Infantry Ridge Road
City: Manassas
StateProv: VA
Email: domains@aol.net
If you look up aol.com IP which on my system resolves to: 207.200.94.2
You get:
OrgName: Netscape Communications Corp.
OrgID: NSCP
Address: 501 E. Middlefield
City: Mountain View
StateProv: CA
PostalCode: 94043
Country: US
But also has this info in McAfee:
AOL.COM.IS.N0T.AS.1337.AS.GULLI.COM
AOL.COM.IS.0WNED.BY.SUB7.NET
AOL.COM.AINT.GOT.AS.MUCH.FREE.PORN.AS.SECZ.COM
AOL.COM
IP Range: 207.200.64.0 - 207.200.127.255
Maybe they have two different offices registering IPs, who knows.
Interestingly when I look up AOL in another IP tracert tool I get:
Administrative Contact:
America Online, Inc.
22000 AOL Way
Dulles, VA 20166
US
Tel. 703 265 4670
Email: *******@aol.net
Technical Contact:
America Online, Inc.
22000 AOL Way
Dulles, VA 20166
US
Tel. 703 265 4670
Email: *******@aol.net
Domain servers:
dns-01.ns.aol.com
64.12.51.132
dns-02.ns.aol.com
205.188.157.232
dns-06.ns.aol.com
149.174.211.8
dns-07.ns.aol.com
64.236.1.107
Yeah it's great for hackers too! The thing about accessing it from anywhere is helpful if you're a spammer or hacker too. The IP address in the logs is the same for all.
AOL provides anonymity for hackers due to the fact that everyone is connecting to the same servers and accessing the Internet and sending messages in a way that is difficult to track back to the actual users. Additionally it is virtually impossible to block because if network admins try to block out the offending IP, they are basically blocking out a whole lot of valid (valuable) traffic from AOL users.
And have you ever tried to figure out how to report an attacker to AOL? Take a look at their web site and just try to figure it out. Impossible...
I have found this article which suggests an address but since it is not official AOL information and Wikipedia lets anyone update the content, who knows if it is accurate or has been hacked? For all we know using this information we could be feeding AOL hackers information that we are onto them and that helps them stay one step ahead:
http://en.wikipedia.org/wiki/Wikipedia:Dealing_with_AOL_vandals
The email listed in here currently to report hackers to AOL is: TOSgeneral@aol.com
If you go to spamcop.net you'll get this abuse email address to report spammers to AOL: abuse@aol.com
Who knows if these emails are valid and your message actually gets to AOL. I have made reports to them with no response, and hackers continue to hit my systems from the same IPS, and the information in McAfee still shows these odd hacker DNS records (more info in my first post on these):
AOL.COM.IS.N0T.AS.1337.AS.GULLI.COM
AOL.COM.IS.0WNED.BY.SUB7.NET
AOL.COM.AINT.GOT.AS.MUCH.FREE.PORN.AS.SECZ.COM
AOL.COM
Interestingly an IP attempting to access my box right has high level domain information which does not match the typical information I see for AOL.
The IP is: 64.12.116.197
The information listed for AOL is:
Address: 10600 Infantry Ridge Road
City: Manassas
StateProv: VA
Email: domains@aol.net
If you look up aol.com IP which on my system resolves to: 207.200.94.2
You get:
OrgName: Netscape Communications Corp.
OrgID: NSCP
Address: 501 E. Middlefield
City: Mountain View
StateProv: CA
PostalCode: 94043
Country: US
But also has this info in McAfee:
AOL.COM.IS.N0T.AS.1337.AS.GULLI.COM
AOL.COM.IS.0WNED.BY.SUB7.NET
AOL.COM.AINT.GOT.AS.MUCH.FREE.PORN.AS.SECZ.COM
AOL.COM
IP Range: 207.200.64.0 - 207.200.127.255
Maybe they have two different offices registering IPs, who knows.
Interestingly when I look up AOL in another IP tracert tool I get:
Administrative Contact:
America Online, Inc.
22000 AOL Way
Dulles, VA 20166
US
Tel. 703 265 4670
Email: *******@aol.net
Technical Contact:
America Online, Inc.
22000 AOL Way
Dulles, VA 20166
US
Tel. 703 265 4670
Email: *******@aol.net
Domain servers:
dns-01.ns.aol.com
64.12.51.132
dns-02.ns.aol.com
205.188.157.232
dns-06.ns.aol.com
149.174.211.8
dns-07.ns.aol.com
64.236.1.107
Subscribe to:
Posts (Atom)