1/10/10
Ad-Hoc Spying
Just some random thoughts which occurred to me. Trojan horses, back-doors, or exploits are pretty well known manners to break a system. Let's use the following terminology. An exploit is some bug you can exploit remotely, like a buffer overrun in ftpd, or an insecurity in domain checks of Javascript where by cross-scripting over different windows you can access local ports. A back-door is a remote functionality placed in the system where you can gain access, for example, a hacked ftpd where the account 'devil666' gives instant access to the machine. A Trojan horse is something all together different, its part of a program or OS which actively searches contact with the outside world, preferably undetected. An example would be your good old-fashioned key-logger build into some kernel module which searches for passwords and sends them out over ICMP.
Now, the above is pretty well-known 'old-skool' hacking. Question is: What can you gain extra by ad-hoc or wireless hacks?
Trojan horses fall into the worst category of hacks and are the most interesting, Trojan horses in the kernel being more severe, and Trojan horses in the hardware the worst category. For spying, owning the root account what most sysadmins fear is not even interesting; ad-hoc gossiping OS parts over wireless would be. I.e., it gives the ability to bypass firewalls and tethered lines locally. [1]
What about dynamically planting memory scanners for honey keys, a code you plant into a document such that it can be traced, and gossiping those to a remote server outside the firewall (FBI)? Or, an Intel hack so you can shutdown all processors in some environment by gossiping a key (US army)? Or, gossiping credit-card information from a PC over Bluetooth to a phone and send that out over the Internet through a browser cookie (black-hat)? Or, just using hacked WiFi phones in the environment for building a remote login tunnel (old-skool hippy)?
A large deal of these hacks are technically possible, but would be too difficult at the moment. But in a few years, where wireless access between desktop/laptop, phone, and -what-do-I-care- a dishwasher will be conceived normal, the door will be wide open.
[1] Some people are unaware how easy it is to place a backdoor in software. But placing a hardhack in hardware is almost as easy as most processors are 'programmed' in a high-level language like Verilog, or VHDL, and subsequently post-processed. Bypassing industrial verification is pretty difficult, and placing a radio on a die and hope that it works -a processor is pretty radio unfriendly- and goes undetected, for that you'll need an EE with extraordinary skills. But still, doable.
A good case against gossiping protocols? One other thought: Why I god's name do I need proprietary software from the KNP to access my USB dongle? Annoying...
Now, the above is pretty well-known 'old-skool' hacking. Question is: What can you gain extra by ad-hoc or wireless hacks?
Trojan horses fall into the worst category of hacks and are the most interesting, Trojan horses in the kernel being more severe, and Trojan horses in the hardware the worst category. For spying, owning the root account what most sysadmins fear is not even interesting; ad-hoc gossiping OS parts over wireless would be. I.e., it gives the ability to bypass firewalls and tethered lines locally. [1]
What about dynamically planting memory scanners for honey keys, a code you plant into a document such that it can be traced, and gossiping those to a remote server outside the firewall (FBI)? Or, an Intel hack so you can shutdown all processors in some environment by gossiping a key (US army)? Or, gossiping credit-card information from a PC over Bluetooth to a phone and send that out over the Internet through a browser cookie (black-hat)? Or, just using hacked WiFi phones in the environment for building a remote login tunnel (old-skool hippy)?
A large deal of these hacks are technically possible, but would be too difficult at the moment. But in a few years, where wireless access between desktop/laptop, phone, and -what-do-I-care- a dishwasher will be conceived normal, the door will be wide open.
[1] Some people are unaware how easy it is to place a backdoor in software. But placing a hardhack in hardware is almost as easy as most processors are 'programmed' in a high-level language like Verilog, or VHDL, and subsequently post-processed. Bypassing industrial verification is pretty difficult, and placing a radio on a die and hope that it works -a processor is pretty radio unfriendly- and goes undetected, for that you'll need an EE with extraordinary skills. But still, doable.
A good case against gossiping protocols? One other thought: Why I god's name do I need proprietary software from the KNP to access my USB dongle? Annoying...
1/8/10
Roof is on Fire!
Security is an interesting thought experiment. Again a post, but now for those whose paranoia level actually went through the roof.
Nothing provides security better than hardware. You can place all your trust in 'capabilities,' and 'prime number factorizations,' but any black-hat OS programmer will happily code around those with a one-liner. A separate ring of company machines with a good hardware firewall gives good protection, like the set-up of the previous post. But you can tunnel through X11, I even have the software on my machine to do that. Of course, for a startup, nothing then of course beats just having the machines with your assets just unconnected to the outside world.
Question is: What would break that? You would need to exploit the fact that some machines have wireless access, which could be done, given any of the two following Trojan horses. One, your OS cannot be trusted, there are means to exploit the hardware through kernel drivers. Two, your hardware cannot be trusted, there are means to access the hardware through exploits.
One is easy, it would assume some hacker on some module providing Internet access through slightly modified kernel drivers. I would say I'll give it a probability of around 40-70% that some modules have hacks.
For two, you'll need a total different level of paranoia. Internet connectivity is one thing, but what about Bluetooth? Ad-hoc gossiping networks can be implemented in a few hundred lines of assembly, add code-division multiplexing into the mix, and you end up with a hack almost no-one can detect. [1]
Who would do the latter? You need a plot where say the CIA works together with Intel 'for the common good.' Unlikely, yes, or given 9/11, maybe. Impossible, no.
What can you do? Walk around with a soldering iron is an option. Build a big cage around your servers is another one. Live in a hole a hundred feet in the dirt with your own electrical supply and feed of worms, a bit over the top I guess. But then, the latter is exactly what banks in the Netherlands do, except for the worms, of course.
[1] You could do this hack on the firmware/OS level too. The hack would be quite trivial, given enough access to hardware/firmware implementations. It basically involves gossiping around a new part of the OS through ad-hoc Bluetooth, or one square mm CIA-owned Intel transistors.
Of course, to some people the idea might seem preposterous, I don't believe it to be true too. But, when looking at possibilities, yes, in sensor networks they are now aiming at one cubic mm nodes, and a radio receiver on an Intel die would be like fitting a shoe into a baseball stadium.
Gave up on kernel modules like e100, Bluetooth, and Hamming Radio.
Extra: Welcome to our brave new 'interconnected' world. In all honesty, its far fetched, but the mere fact that a phone works inside a bank, should be assessed as a liability in the coming decades. On the flip-side, when it comes to exploits and Trojan horses, I didn't even start yet.
Nothing provides security better than hardware. You can place all your trust in 'capabilities,' and 'prime number factorizations,' but any black-hat OS programmer will happily code around those with a one-liner. A separate ring of company machines with a good hardware firewall gives good protection, like the set-up of the previous post. But you can tunnel through X11, I even have the software on my machine to do that. Of course, for a startup, nothing then of course beats just having the machines with your assets just unconnected to the outside world.
Question is: What would break that? You would need to exploit the fact that some machines have wireless access, which could be done, given any of the two following Trojan horses. One, your OS cannot be trusted, there are means to exploit the hardware through kernel drivers. Two, your hardware cannot be trusted, there are means to access the hardware through exploits.
One is easy, it would assume some hacker on some module providing Internet access through slightly modified kernel drivers. I would say I'll give it a probability of around 40-70% that some modules have hacks.
For two, you'll need a total different level of paranoia. Internet connectivity is one thing, but what about Bluetooth? Ad-hoc gossiping networks can be implemented in a few hundred lines of assembly, add code-division multiplexing into the mix, and you end up with a hack almost no-one can detect. [1]
Who would do the latter? You need a plot where say the CIA works together with Intel 'for the common good.' Unlikely, yes, or given 9/11, maybe. Impossible, no.
What can you do? Walk around with a soldering iron is an option. Build a big cage around your servers is another one. Live in a hole a hundred feet in the dirt with your own electrical supply and feed of worms, a bit over the top I guess. But then, the latter is exactly what banks in the Netherlands do, except for the worms, of course.
[1] You could do this hack on the firmware/OS level too. The hack would be quite trivial, given enough access to hardware/firmware implementations. It basically involves gossiping around a new part of the OS through ad-hoc Bluetooth, or one square mm CIA-owned Intel transistors.
Of course, to some people the idea might seem preposterous, I don't believe it to be true too. But, when looking at possibilities, yes, in sensor networks they are now aiming at one cubic mm nodes, and a radio receiver on an Intel die would be like fitting a shoe into a baseball stadium.
Gave up on kernel modules like e100, Bluetooth, and Hamming Radio.
Extra: Welcome to our brave new 'interconnected' world. In all honesty, its far fetched, but the mere fact that a phone works inside a bank, should be assessed as a liability in the coming decades. On the flip-side, when it comes to exploits and Trojan horses, I didn't even start yet.
1/6/10
Securing IT
Httpd was running file sharing turned on without authentication? [1] Now thats a security breach if ever. Not sure about the rest, 'chkrootkit' and 'rkhunnter' are apparently unreliable on Linux systems, so there's no way of determining the system is hosed. Apart from that, its impossible to protect against an exploit in Mozilla, since that would go unnoticed. I.e., a Javascript/plugin exploit is a 'runtime' exploit, no files are changed on the system, and forensics can only be done on a complete memory dump.
Jailing Mozilla in a separate account would be a partial answer.
There is no way to determine if the system is broken, except for the fact that I don't like the number of outbound connections made, and some behavior of the machine doesn't seem okay. I sometimes play around designing my own server park for a small company, so far, it would boil down to:
[1] Webdav, file sharing for the masses. Yeah right, have javascript connect to the local webdav port on a machine?
Doesn't solve the USB stick, or the sysadmin, problem. A substantial number of your average medium-company-sized under-payed sysadmin is a black-hat by nature, driven by 'Oh! You think your system is secure? Alright then.." and most of em can be found on freenet anyway, or some illegal IRC, exchanging whatever company info they feel like. But, it stops somewhere.
Jailing Mozilla in a separate account would be a partial answer.
There is no way to determine if the system is broken, except for the fact that I don't like the number of outbound connections made, and some behavior of the machine doesn't seem okay. I sometimes play around designing my own server park for a small company, so far, it would boil down to:
- A server with the OS with a HD with a big red button which says: 'READ-ONLY.'
- A file server.
- Company work machines, light clients.
- A firewall, blocking everything except for X11/VNC.
- A secured server for Mozilla, only to be used for that application.
- A separate mail/webserver which handles mails through a http client.
- A firewall which protects most ports, probably even blocks outbound https.
- Windows machines.
- A logger which spies on traffic going in and out.
[1] Webdav, file sharing for the masses. Yeah right, have javascript connect to the local webdav port on a machine?
Doesn't solve the USB stick, or the sysadmin, problem. A substantial number of your average medium-company-sized under-payed sysadmin is a black-hat by nature, driven by 'Oh! You think your system is secure? Alright then.." and most of em can be found on freenet anyway, or some illegal IRC, exchanging whatever company info they feel like. But, it stops somewhere.
1/5/10
Obscure...
God, I might even be looking at Google/Ajax, or I might be looking at a compromised browser Google/Ajax hack. Guess it is starting to fall into the whatever category. ET phone home?
ET phoned home, system hosed. Httpd running at places it shouldn't. Installs of rootkit checks don't show up in history/logs. Login behaves erratically. Ah well.
For those not sufficiently paranoid: At one company I worked in, machines were hacked 5-10% continuously, so far for Windows or Linux, and a continuous practice of spying through rich content mails. The latter is/was rather easy, instead of loading a picture, Javascript is loaded and the content of the mail/forward/reply is pushed back. Mails could be tracked throughout whole companies.[1]
For an exploit in Mozilla, you just need an exploit in HTML/ Javascript/ css or a plugin, and you can start pulling/pushing stuff to some Google account at will. On a last note, on the Internet, its hardly a question of 'if,' but 'when.'
Actually, in my experience, for most companies, the biggest problem probably isn't even security but the sysadmin.
[1] A good reason to quit, btw.
ET phoned home, system hosed. Httpd running at places it shouldn't. Installs of rootkit checks don't show up in history/logs. Login behaves erratically. Ah well.
For those not sufficiently paranoid: At one company I worked in, machines were hacked 5-10% continuously, so far for Windows or Linux, and a continuous practice of spying through rich content mails. The latter is/was rather easy, instead of loading a picture, Javascript is loaded and the content of the mail/forward/reply is pushed back. Mails could be tracked throughout whole companies.[1]
For an exploit in Mozilla, you just need an exploit in HTML/ Javascript/ css or a plugin, and you can start pulling/pushing stuff to some Google account at will. On a last note, on the Internet, its hardly a question of 'if,' but 'when.'
Actually, in my experience, for most companies, the biggest problem probably isn't even security but the sysadmin.
[1] A good reason to quit, btw.
1/4/10
Can you Trust your Friend, the Browser?
A post for the sufficiently paranoid, that is, aimed at system administrators.
Usually, sysadmins aim at securing their machines by making sure nobody can gain root access to it, since that would give outside users the privileges to do anything: Install software, spambots, illegal data, spy on the machine.
But what about something as simple as a browser? A browser has user level privileges, but can both connect to the outside world and run local commands. Hacking a browser gives an outside party all information on the surfing behavior of a person, the work he is doing, and contacts he has. Moreover, since a browser accesses the outside world 'erratically,' its hard to see its compromised. One outside going http connection to some machine infrequently is hard to notice, and it has a big cache of temporary data where a lot can be hidden. Moreover, a browser is a large body of software, it consists of hundreds to thousands of packages, where any compromised package may mean a compromised browser. To an outside party, it may be more interesting to hack the browsers of a company, or al Qa'ida, than to gain root access to the machines.
And now for the paranoid plot. The hackers on Mozilla can normally be trusted, we can assume they are either teenagers, or your normal smelly hippy do-good nerd. But when it comes to trust: Do you trust the malignant hacker aimed at making money through spam? Or, for that matter, the Chinese, the Israeli, IBM?
One backdoor in the open-source project Mozilla, which may be as big as ten lines, would give, say the Chinese, who have a substantial cybercrime division, spying access to each and every user who installed Firefox. And subsequently all data, or, through exploits, root access. That is not to say that IE can be trusted that much more, but still...
I guess if you would derive the probability from all probabilities of all possibly interested parties who subsequently also did it and got away with it, you'll end up with a chance bigger than one.
Usually, sysadmins aim at securing their machines by making sure nobody can gain root access to it, since that would give outside users the privileges to do anything: Install software, spambots, illegal data, spy on the machine.
But what about something as simple as a browser? A browser has user level privileges, but can both connect to the outside world and run local commands. Hacking a browser gives an outside party all information on the surfing behavior of a person, the work he is doing, and contacts he has. Moreover, since a browser accesses the outside world 'erratically,' its hard to see its compromised. One outside going http connection to some machine infrequently is hard to notice, and it has a big cache of temporary data where a lot can be hidden. Moreover, a browser is a large body of software, it consists of hundreds to thousands of packages, where any compromised package may mean a compromised browser. To an outside party, it may be more interesting to hack the browsers of a company, or al Qa'ida, than to gain root access to the machines.
And now for the paranoid plot. The hackers on Mozilla can normally be trusted, we can assume they are either teenagers, or your normal smelly hippy do-good nerd. But when it comes to trust: Do you trust the malignant hacker aimed at making money through spam? Or, for that matter, the Chinese, the Israeli, IBM?
One backdoor in the open-source project Mozilla, which may be as big as ten lines, would give, say the Chinese, who have a substantial cybercrime division, spying access to each and every user who installed Firefox. And subsequently all data, or, through exploits, root access. That is not to say that IE can be trusted that much more, but still...
I guess if you would derive the probability from all probabilities of all possibly interested parties who subsequently also did it and got away with it, you'll end up with a chance bigger than one.
1/3/10
System is Compromised
I use an old web-browser Galeon. Turns out it is compromised, at least, it might be? Sometimes I run netstat. When starting up, the browser connects to various machines, it seems someone is tunneling to my machine. Except for leaking information, of a maybe hopefully expensive compiler, and connecting to machines I might not like, I don't think a lot has happened.
Its a Unix machine, so people can do 'everything' on my machine remotely, so that's usually pretty bad. It happened before. Ten years ago when I had a server with a broadband connection, scripted hacking attempts averaged about 3-10 times a day since outside hackers can only see its a Unix machine and subsequently assume its a company server since they can hardly differentiate. But I never had anything worthwhile on my machine, so, then it was a whatever.
See if there's a rootkit installed. There don't seem to be extra files.
Its either in the Mozilla package or Javascript engine. Its pretty much confirmed, even when loading a trivial file, after a while, tcpdump shows that http connections are opened to a series of machines and there's a lot of information going over them continuously.
Its always pretty bad under linux, only a complete reinstall fixes it, and I don't feel like.
Guess I'll second check. It might just be Mozilla pinging home.
Its a Unix machine, so people can do 'everything' on my machine remotely, so that's usually pretty bad. It happened before. Ten years ago when I had a server with a broadband connection, scripted hacking attempts averaged about 3-10 times a day since outside hackers can only see its a Unix machine and subsequently assume its a company server since they can hardly differentiate. But I never had anything worthwhile on my machine, so, then it was a whatever.
See if there's a rootkit installed. There don't seem to be extra files.
Its either in the Mozilla package or Javascript engine. Its pretty much confirmed, even when loading a trivial file, after a while, tcpdump shows that http connections are opened to a series of machines and there's a lot of information going over them continuously.
Its always pretty bad under linux, only a complete reinstall fixes it, and I don't feel like.
Guess I'll second check. It might just be Mozilla pinging home.
Subscribe to:
Posts (Atom)
