Vacuum

Collected Articles on Code Reconstruction, Katharine Swift, 1976, as announced in CRYPTOLOG

The National Security Agency has declassified a number of issues of CRYPTOLOG, their in-house magazine. Here's an example from 1977, announcing the publication (for anyone with a Top Secret Codeword clearance) of Katharine Swift's "Collected Articles on Code Reconstruction".  "It is hoped that managers as well as book-breakers and programmers, and senior analysts as well as neophytes, will find material that will help each in making his individual contribution on the job."

SEC Consult Vulnerability Lab Security Advisory: "Critical SSH Backdoor in multiple Barracuda Networks Products"

The full security advisory is here:

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130124-0_Barracuda_Appliances_Backdoor_wo_poc_v10.txt

Some industry reaction:

Information Week:

According to SEC Consult, however, the security definitions update still leaves three accounts on all devices -- cluster, remote, root -- which Barracuda told it are "essential for customer support and will not be removed." But SEC Consult warned that the password for the "root" account can be cracked, if it isn't sufficiently strong, and noted that although only Barracuda possesses the private key for the passwords for the "cluster" and "remote" accounts, this is a security problem. "This still leaves considerable risks to appliances as the password for the 'root' user might be crackable and the relevant private keys for the 'remote' user might be stolen from Barracuda Networks," said SEC Consult. "In secure environments it is highly undesirable to use appliances with backdoors built into them. Even if only the manufacturer can access them." 

Security Week repeats mostly the same news.

The Register is characteristically sharp-tounged:

Backdoor root login found in Barracuda gear - and Barracuda is OK with this; Hidden accounts 'needed for remote tech support'

Remote tech support is hard work, as is systems security.

More computer security problems in more systems; "not only hashed and salted, but pan-seared and dusted with a saffron quince reduction"

When you notice a big LinkedIn password breach one day, and then several other sites also announce problems in subsequent days, there seems to be a pattern worth noticing. Here's what I've noticed of late.

 

Ars Technica reports that the Flame virus uses a previously undiscovered attack on the MD5 cryptographic hash in order to carry out some of its devious work. 

Flame is the first known example of an MD5 collision attack being used maliciously in a real-world environment. It wielded the esoteric technique to digitally sign malicious code with a fraudulent certificate that appeared to originate with Microsoft. By deploying fake servers on networks that hosted machines already infected by Flame—and using the certificates to sign Flame modules—the malware was able to hijack the Windows Update mechanism Microsoft uses to distribute patches to hundreds of millions of customers.

Taking over Windows Update is game over for a compromised system, and of course it's also an efficient way to keep your bugged system up to date with the latest bugs. Flame is thus suspected of being created by a powerful nation-state, since the crypto needed to do this is beyond the grasp of but a few skilled mathematicians.

 

Bricklink is reporting that their admin user id was stolen, and a number of accounts were fraudulently merged together. No word yet on how the attacker(s) got access to the key account on the system, and I haven't seen any other reporting about problems at this LEGO trading site.

As a few people noticed, a number of major accounts were merged fraudulently around 12:15 pm EDT today. As a merge is almost impossible to undo, the solution was to do a database rollback to 12:00 PM EDT today. This breach was due to the Admin user ID being stolen.

 

TheNextWeb writes about problems at last.fm which is reporting a big password leak on the scale of LinkedIn. The last.fm notice reads in part

We are currently investigating the leak of some Last.fm user passwords. This follows recent password leaks on other sites, as well as information posted online. As a precautionary measure, we’re asking all our users to change their passwords immediately.

 

Passwords are a weak link in many online systems, and password database security gets short shrift in some growing startups. Perhaps these two tweets from Pinboard's founder Maciej Ceglowski are worth noting to round out the report.

Pinboard ‏@Pinboard Proud to reassure my users that Pinboard passwords are not only hashed and salted, but pan-seared and dusted with a saffron quince reduction

Pinboard ‏@Pinboard (rightly) exasperated security person asks me to admit that Pinboard uses bcrypt. But there is no known way to make a bcrypt tweet funny

 

More on bcrypt from Coda Hale.

LinkedIn has had a password leak. How to repair it.

Change your LinkedIn password.

News emerged on Wednesday, June 6, 2012 that LinkedIn had a leak of its password database. This was confirmed as a number of security researchers identified their own password hashes in the file, as well as a number of cracked passwords from that file that had the string "LinkedIn" or some variant in the text. You can protect yourself by changing your LinkedIn password, and by also changing any other passwords that you use which are the same. LinkedIn, for its part, has promised to strengthen its internal controls and introduce a "salt" into its password storage system. 

An update from LinkedIn acknowledges the leak. The reporting from CNN is unusually detailed:

Countless passwords on the list contain the word "linkedin." On a popular hacker forum, many reported finding passwords such as "linkedout," "recruiter," "googlerecruiter," "toprecruiter," "superrecruiter," "humanresources" and "hiring."

The leak was complicated by LinkedIn's use of SHA-1 as its encryption scheme for passwords without using a "salt" to improve password security. AgileBits has a good discussion of how salting works, and why you should use it; in short, it adds a little more randomness to even bad passwords so that an attacker can't pre-compute the hashed stored passwords directly.

Even if Bot and Alice use the same password (and so have the same hash of their passwords) they don’t have to worry about each other. Who they need to worry about is Charlie the Cracker. Charlie may have spent months running software that picks passwords and generates the hashes of those passwords. He will store those millions of passwords and their hashes in a database called a “Rainbow Table.”

Even without a rainbow table, modern password cracking hardware is mighty fast. How fast? Robert Graham from Errata Security lays it out:

Update: How fast can hackers crack passwords? The answer "2 billion per second" using the Radeon HD 7970 (the latest top-of-the-line graphics processor). Each letter of a password has 100 combinations (UPPER, lower, d1g1ts, $ymbols). A 5 letter password therefore has 100 x 100 x 100 x 100 x 100 or 10 billion combinations, meaning it can be cracked in 5 seconds. A 6 letter password has 100 times that, or 500 seconds. A 7 letter password has 100 times that, or 50,000 seconds, or 13 hours. An 8 character password is roughly 57 days. A 9 character password is 100 times that, about 15 years. In other words, if your password was 7 letters, the hacker has already cracked it, but if it's 9 letters, it's too difficult to crack with brute force.

Of course, "too difficult" for one computer is not the same as "too difficult" for a network of computing resources. Thomas Roth in 2010 on Cracking Passwords in the Cloud on Amazon's EC2:

Using the CUDA-Multiforce, I was able to crack all hashes from this file with a password length from 1-6 in only 49 Minutes (1 hour costs 2.10$ by the way.):

Compute done: Reference time 2950.1 seconds
Stepping rate: 249.2M MD4/s
Search rate: 3488.4M NTLM/s

This just shows one more time that SHA1 for password hashing is deprecated – You really don’t want to use it anymore! Instead, use something like scrypt or PBKDF2! Just imagine a whole cluster of these machines (which is now easily available to anybody thanks to Amazon) cracking passwords for you. Pretty comfortable, large-scale password cracking for everybody!

So 6 character SHA-1 hashes would cost about $2 to crack in 2010 computer-dollars; 7 characters, $200; 8 characters, $20,000; and 9 characters, "only" $2 million. Roth further concludes:

The thing that was new is that, due to the new Amazon offering, everyone is able to spawn a 100-or-more node cluster in the cloud and distribute the task of cracking passwords onto these nodes. The task of cracking hashes is especially suitable for massive parallelization! An attacker could easily spawn a gigantic cluster of nodes using stolen credit card information, and it would be no problem for him to crack 8-character passwords in a nice timeframe.

So, "recruiter", step up your game (and change your password, and your password algorithm).

that image of the spreadsheet in the PDF you sent me is not the public record you are required to share

I've become one of those people who requests and then reads the "board packets" for meetings of public bodies.  These are fascinating things, generally 50-150 page tomes of memos, spreadsheets, graphs, charts, and news clippings that the staff of a public body will prepare for its board to go into a public meeting.

The fascinating thing from a technical point of view is just how many of these board packets include spreadsheets, and how many of the spreadsheets are presented either as bitmapped images or as text-only documents.  In either case, there's no way to know how the spreadsheet is constructed, whether the totals presented really add up to the totals displayed, and what if anything is hidden in the model used to come up with the numbers.

The latest one of these I'm getting clarification on is a spreadsheet where the numbers simply don't add up - one row of expenses where the sum of the figures doesn't jive with the total presented.  And I can't look at that without thinking a lot more about what else I might be missing, either by accident or design.

Not that anyone would deliberately hide things in a spreadsheet, though it's been known to happen in my little town:  from CFO.COM:

The former CFO of a company that produces electronic databases of archived information from publishers settled charges made by the Securities and Exchange Commission that, with the use of spreadsheet aids, he made fraudulent monthly and quarterly and accounting entries for more than five years.

As part of the alleged scheme, Scott Hirth, who was vice president of finance and CFO of the information and learning division of ProQuest Company from 1999 through 2005, created false documentation to back up the balances in accounts he allegedly manipulated, according to the SEC. His account-reconciliation spreadsheets, for instance, contained "hidden rows" so that false account entries didn't show up when they were printed in hard copy, according to the complaint.

Related Articles

• Spreadsheets: Formula for Success
• Sloppy Spreadsheets: Readers Speak Out
• Spreadsheet "Worst Practices"
• Spreadsheets: Fear No Evil
• Tickling the Keyboard: 10 Spreadsheet Tips

The former finance chief also allegedly covered up false information by rendering it invisible through the use of "white font," or white-colored text, in the spreadsheets, the commission charged.

White font!  I guess that beats using white-out on the printouts.

Privacy and security course from Don Blumenthal at the UM School of Information

Don Blumenthal is teaching this course at Michigan in the winter term:

Snippet from a course announcement for a winter class to be
taught by Don Blumenthal at the U-M School of Information:

This course will examine: 1) privacy issues related to the
safeguarding of sensitive information against inadvertent disclosure;
2) policy and societal questions concerning the value of security and
privacy regulations, the real world effects of data breaches on
individuals and businesses, and the balancing of interests among
individuals, government, and enterprises; 3) current and proposed laws
and regulations that govern data security and privacy; 4) self-help
and private sector regulatory efforts; 5) emerging technologies that
may affect security and privacy concerns; and 6) issues related to the
development of enterprise data security processes and programs that
take into account the requirements of all relevant constituencies:
e.g., technical, business, and legal.

Thanks to Brian Kerr for the pointer; more from and about Don Blumenthal on LinkedIn.

Technorati Tags: infosec, privacy, hosting, security, don-blumenthal, via:bkerr

Identity swap

When Jim Benson opened up his web browser one day, he discovered that he was someone else. One of the perils of using borrowed hardware to establish a temporary identity is that if you are not really careful, you can leave quite a bit of your identity behind.

This is as good a reason as any to put your temporary identity on a thumb drive, so that you don't leave droppings behind that cause confusion (or worse). Jeremy Wagstaff's Directory of Programs Designed for USB Drives is a good place to start for mostly Windows setups; Lifehacker's Carry your life on a thumb drive is good too.

Spam and the Limits of Interpersonal Collaboration / Nathaniel Borenstein / MOCHI / Feb 14 2007 / U of Michigan / 411 West Hall / 6pm

Dr. Nathaniel S. Borenstein will present at the next MOCHI meeting:

Spam and the Limits of Interpersonal Collaboration

Where: University of Michigan - 411 West Hall (Ehrlicher Room)

Feb 14, 2007
at 6:00pm (arrive eat network)
at 6:30pm (talk begins, lasting around an hour + Q&A)

Event Description:
Spam is an extremely complex and, so far, remarkably intractable problem, increasingly affecting not just email but virtually every kind of interpersonal electronic communication. In this talk, I will summarize the state of the art, survey the remarkably wide set of antispam activities currently under way at IBM and elsewhere, and present the outlines of a comprehensive strategy to fight spam. Unfortunately, the bottom line remains that we are still working very hard just to keep the spam problem from getting worse, and no one should expect a quick or painless solution to this problem. However, the fight against spam has the potential to advance technology in several ways that might be broadly useful in enabling new kinds of Internet infrastructure.

Dr. Nathaniel S. Borenstein is an IBM Distinguished Engineer, responsible for research and standards strategy for the Lotus brand. He has been an Internet user, innovator, standardizer, entrepreneur, and social activist since 1980. His credits and collaborations include the MIME standard, the Andrew Mail System, the metamail software, the Safe-Tcl programming language, the first working Internet payment system, the startups First Virtual Holdings and NetPOS.com, "Programming as if People Mattered" and two other books, three patents,and the "One Planet, One Net" manifesto. He is a past president of Computer Professionals for Social Responsibility, and former faculty member at the University of Michigan School of Information and at Carnegie-Mellon University.

Event Website URL: http://www.mochi.org/
This event is public.

--

Technorati Tags: annarbor, michigan, nsb, spam, umsi

The Doomsday Click (Michael Specter, The New Yorker / Assistive Media)

The Doomsday Click (MP3) is a Michael Specter piece from May 2001 on the engineering and spread of malware on the Internet. The full text is available. The MP3 is part of a collection at Assistive Media of New Yorker articles available as audio - good listening there.

Some things mentioned there include

Peter G. Neumann's RISKS Digest, Forum On Risks To The Public In Computers And Related Systems.

"To do this stuff is utterly trivial," Peter G. Neumann, who is a principal scientist at SRI International, the technological consulting firm, told me. "Every other kid can do it, and we know that. That isn't what worries me." Neumann, who is sixty-eight, has worked at and advised many of the nation's most important universities and government institutions, from the Navy and Harvard to the highly secretive National Security Agency. Mostly as a hobby, he moderates a forum on the Internet and produces a running list called "Illustrative Risks to the Public in the Use of Computer Systems and Related Technologies," which is the most frightening collection of random dangers I have ever seen. "What worries me is the big one," Neumann said, as we sat in his office in Menlo Park, California, one day. "People don't like to talk about this, because it's seen as encouraging the enemy, but absolutely everything is riddled with security flaws. Hackers can get into our most important systems in minutes, sometimes in seconds.

"And they do," he added. "The Internet is waiting for its Chernobyl, and I don't think we will be waiting much longer; we are running too close to the edge. When a third of the computer drives in America are wiped out in a single day, when the banking and commerce system is overcome, or the power grids and emergency-response systems of twenty states shut down because of a malicious computer attack, maybe then people will think about what's going on here."

Bruce Schneier's Schneier on Security blog.

"Computer security is a forty-year-old discipline," Bruce Schneier told me not long ago. Schneier created two of the most heavily used encryption algorithms, and his recent book on digital security, "Secrets & Lies," is perhaps the best popular exploration of the subject. "Every year, there is new research, new technology, and new products," he said. "Really good research, really good technology, and really good products. Yet every year the situation gets worse. Much worse. The Internet is just too complex to secure."

So Schneier decided to stop trying. Instead, he started Counterpane Internet Security, which relies on the skills of humans, flawed and inconsistent as they are, to manage the risks. Counterpane installs a special warning box--a Sentry--in every computer network it monitors. The sentries funnel information to a central knowledge base that keeps track of each client's idiosyncrasies. "We are like a fire brigade," Schneier told me. "Or an emergency room. In the real world, this kind of expertise is always farmed out."

Counterpane was recently acquired by British Telecom.

Google blog hacked - alleged hole in Metaweblog API

Techcrunch reports "Strange things afoot at the Google blog", with an unauthorized post sneaking into their Blogger-hosted offiical news blog. This comment is recent.

# Mike McMan

October 8th, 2006 at 7:05 pm

The bug that was used to hack Google’s blog is not a Blogger specific bug, it is a bug in RSS and MetaWeblogAPI. All blogging platforms that support the two are vulnerable including Blogger (now fixed), Wordpress, and Typepad. Currently no details on how the bug works have been made public and there are no official patches for it.

This qualifies as unconfirmed rumor in my book, but if you run a blog platform it would make sense to XYZ, PDQ.

Technorati Tags: infosec, google, blogger, metaweblog, typepad, wordpress, movabletype, rumor, innuendo, techcrunch