Spire Security Viewpoint

Sony (not a) Rootkit Impact

I just caught wind of an InformationWeek article reporting that the Van Zant album that Mark Russinovich bought has had its rating on Amazon reduced from 3 1/2 stars to 1 1/2 stars. Ratings are an interesting and potentially useful approach for folks opposed to DRM. It is likely to be more useful than the typical protest - the success of the DRM-laden iPod is a good indicator that the mass market doesn't really care about DRM. It works two fairly obvious ways - first, to convince others directly not to buy it, and second, to strike at the ego of the artist.

Even more interesting in this case is the conflicting interest of World of Warcraft players who can use the stealth capability of Sony's DRM to hide from WoW's "DRM" function. So competing priorities will either drive up or down Van Zant's record sales.

It would be really interesting to know how many albums were bought on either side of the equation - if more albums are bought for the purposes of breaking WoW DRM, then I think that is an indicator that DRM should be used because there are more pirates than benign anti-DRMers. If less are sold, then there are more benign anti-DRMers.

Unalarmed Users Over Sony (not a) Rootkit

Just caught this excerpt from an article in the Register about Sony's "rootkit":

It is alarming how little outrage there is from ordinary PC users. While Register readers are well versed in the restrictions of DRM and the dangers of malware, there's little sign the public shares this knowledge.

Note to all security professionals: if this is alarming to you, you need to spend a lot more time in the real world. This is very much the rule, not the exception.

Just Being "Helpful"

Check this out (via Infosecurity News):

The employee went on to say she erased five years of zoning files because Leitch "has never taken care of her computer system. She has had numerous virus(es). No matter what, apparently, she doesn't feel the need to update and back up her system."

I wonder if she thinks she was doing "the community a service"....

The "Name Dropping" Worm

Anyone that has used Linked In knows that there is a subset of people who simply want to collect the largest number of "contacts" they possibly can (I actually get nervous by the amount of people who are apparently willing to "recommend" me even though they barely know me). I am pretty sure the issue of quantity vs. quality with these types of community networks has been brought up, probably a number of times.

Now, you don't even need anyone's permission to become a "contact" - just write a little javascript worm. "samy" did just that on myspace.com and apparently had over a million best friends within a day or so. Read his whole story - on the surface, it is pretty funny.

Of course, my security professional hat knows how painful it must have been for the security folks at myspace.com to recover. I can only imagine the costs involved. Actually, I can estimate them - since Intermix Media did $79 million in its most recent fiscal year (year ended March, 2005), that translates out to about $65k an hour of revenue (assuming all revenue is generated online). Samy says the servers were down for about 2.5 hours for about $160k in lost revenue. I don't know what their burn rate is, but it is not uncommon for it to be higher than revenue, so I will take the $160k and reduce it by half to account for unrelated costs (I would include IT salaries and IT cost of capital, so I think for an ebusiness, 50% of expenses is reasonable). For a grand "back of the napkin" total of $240k.

The impact on global networks is even more interesting: the more reputation economics, or Whuffies if you like Cory Doctorow, are leveraged for some sort of status, the more important they become to everyone and the more significant the damage.

The technique used is interesting as well. It looks like samy used a lot of obfuscation techniques just to get his script to run. In addition, he leveraged XML-RPC. It isn't too hard to begin to imagine what could possibly happen in an online marketplace like eBay, for example, if some of these techniques were used. Or B2B marketplaces where thousands or millions of dollars are changing hands. The heck with reputation, now its a money thing...

Tsunami Hacker

So a guy worries that he might have been phished and runs some attacks against a tsunami donation website. Not only was he unsuccessful, but BT (the site hoster) was using "dead" technology (that would be IDS ;-)) and caught him.

I am a bit torn in this case. On the one hand, I don't want security vigilantes running around looking for vulnerabilities, but on the other hand, it doesn't seem like he had malicious intent. This is what is annoying about our profession - we feed our young to the authorities when they act on the bluster that's out there about doing good by doing bad. (I really don't get the whole "police are gonna pay for this" baloney. Sure, the vigilante "security consultants" out there will stay away, but those BT security professionals probably don't mind at all.)

For discussion:

• What if the defendant (Daniel Cuthbert) were to claim that he actually was phished? Would he have ended up like this lucky guy?
• What good could come from running scripts against a web server involved in a phishing attack? (caveat: it is not completely clear what the technical details are to this story). Either it is run by bad guys in which case it probably would have been gone by the time Cuthbert went back, or it was a compromised legitimate server...but why wouldn't he have simply looked at his URL history and parsed it out? (I am guessing a cross-site scripting test here) or gone back to the banner ad he clicked on?

Zotob: Dun & Bradstreet Speaks...

In the next 60 minutes in our U.S. records …

• 251 businesses will have a suit, lien or judgment filed against them
• 246 business telephone numbers will change or be disconnected
• 58 business addresses will change
• 81 directorship (CEO, CFO, etc.) changes will occur
• 41 new businesses will open their doors
• 11 companies will change their names
• 7 businesses will file for bankruptcy

...and .000001 "corporations" will get infected with Zotob.

Inside Job: GE Money in Helsinki

The 26-year-old head of data security at GE Money (I guess we would call him a CISO) in Helsinki, Finland was recently arrested for allegedly stealing EUR200,000 (note the linked story says EUR20,000 but other stories indicate 200,000 - also said this is about $245k):

Pekka Pattiniemi, general manager for GE Money in Finland, told reporters that the security officer was immediately dismissed.

Apparently, stealing is against GE Money's Acceptable Use Policy ;-) Okay, I shouldn't make light of the story, and actually this article lends more interesting information:

The data security chief said during interrogation that he had been forced into the crimes by one of the other suspects, a 43-year-old man with a criminal background...The data security chief claimed that unknown men had forced him to bring the company’s laptop to a certain video store in Helsinki a few days before the transaction. He said that pressure had also been put on his family.

Here are some details on what is alleged to have happened:

• The CISO stole bank software and passwords from the bank and installed them on a bank-owned laptop. He brought it to a somebody at a video store (not pertinent - just a little flavor).
• The laptop connected through a wireless LAN to access the bank and transfer EUR200,000.
• Someone was caught trying to withdraw EUR5,000. (At least 4 people are suspected.)
• Police initially suspected the owner of the WLAN but then found the laptop's MAC address in the logs of the ADSL modem. (I think the security manager was a neighbor).
• The MAC address was traced to GE Money and then the security manager.

The transaction must have been flagged as suspicious pretty early and the IP address traced to the WLAN in question so they could catch the guy during the withdrawal. I wonder why the CISO didn't know about the controls in place? My guess is that transaction procedures must have provided the initial suspicion.

The Effect of Evidence in a Criminal Case

It seems sort of silly to have a post with this title, but Bruce Schneier appears to miss the point in his post about a Cryptographically-secured Murder Confession. Schneier writes:

But how is this different than Duncan speaking the confession when no one was able to hear? Or writing it down and hiding it where no one could ever find it? Or not saying anything at all?

The answer is simple: this encrypted set of bits may be evidence in a criminal investigation. It differs from his other scenarios in that nobody has any reason to know that the other pieces of evidence exist (if they did, they would be looking for them). In this case, there appears to be a reason to believe the encrypted data is a confession. And the police want to "collect" the information in the same way they would act on tips or other evidence to look for a murder weapon in somebody's house, drugs in a car, receipts to confirm an alibi, witnesses of a robbery, etc. etc. I think they call it "a lead".

I think Schneier is so blinded by his concern that cryptography is (perhaps) seen as evil that he misses the basic point. It isn't about encryption, it is about the ease or difficulty of getting enough evidence to convict somebody. [Btw, I don't see anything in the AP report he cites that denotes or connotes anything about encryption being good or bad - just sometimes hard to decrypt.]

Indeed, Schneier seems to expose his blind side with another comment:

If the police can't convict him without this confession -- which we only have his word for as existing -- then maybe he's innocent?

This is so strange, and states the case of the police so clearly (they want any possible evidence to either convict the right guy) that I still am trying to decide whether it is sarcasm or not. The doubt Schneier shows is the same doubt that a jury may have and that the police want to minimize with the confession, if it exists in the myriad of potential evidence collected.

What if a witness can't be found? What if a partial fingerprint can't be matched? What if a suspect has an alibi? What if a confession is encrypted? Well, any citizen would presumably want the police to try harder if they have a reason. Authorities should look for any and all evidence they can find to support or refute any investigations, and this is no different simply because the potential evidence is encrypted.

Mr. Shostack, Tear Down that Wall!

Update: TQBF weighs in below with a comment: "I don't understand. Wouldn't we be better off if he didn't disclose those details?" Answer: Of course not. My entire point is that we should be seeking out and destroying (or at least neutralizing) these capabilities rather than spinning wheels with the comfort food being fed to us by white hats. It is the "in-the-wild exploit against an undercover vulnerability" that I want everyone to focus on.

Adam at Emergent Chaos says:

"to Pete's question about how I know that there's lots of exploit code, it's easy. I've worked for organizations that took security seriously enough to detect and analyze new attacks. We regularly saw people exploiting unannounced flaws in our systems."

We are at a point in time in the security world where details like this are extremely helpful, and there are people who could actually make good use of them. I can only hope that Adam sees fit to provide some details, any details.

Not to badger, but we are still stuck with words that are often used in vague ways. I can't help it that many people in our profession are stuck in the "I'd tell you but I'd have to kill you" frameset. In this case, "regularly" and "unannounced" fit the bill, as does the possessive form "our systems" which often implies configuration weaknesses or custom app layer attacks rather than the ones attacking flaws in commercial platforms.

Disney Strangeness

Very strange, statistical anomaly, or "something else"?:

• THURSDAY: A 12-year-old girl died that evening after passing out at the wave pool at Disney's Typhoon Lagoon.
  
• JULY 12: Leanne Deacon, 16, of Kibworth, England, suffered cardiac arrest shortly after exiting Disney-MGM Studio's Twilight Zone Tower of Terror thrill ride. A CT scan after her collapse showed she was bleeding in her brain.
  
• JUNE 13: Daudi Bamuwamye, 4, of Pennsylvania collapsed on Epcot's Mission: Space ride and later died. Inspections showed no signs of ride malfunction, and investigators are awaiting results of a medical examiner's report.

Whatever the case, you gotta feel for the parents (and the kids themselves).