People form weak link in transaction security
Every security system, in the end, depends on people. Ideally, programs could be written with restricted privileges for operators so they would pose no threat - but I doubt it would work in practice.
I believe our staff is honest, but I'm not sure we can rely on employee inertia to protect us where money is involved. To determine the scope of any potential problems, we recently reviewed our 30 funds-transfer systems.
Tuesday, August 20, 2002
Wireless Security Blackpaper
In 1999 the IEEE completed and approved the standard known as 802.11b, and WLANs were born. Finally, computer networks could achieve connectivity with a useable amount of bandwidth without being networked via a wall socket. Suddenly connecting multiple computers in a house to share an Internet connection or play LAN games no longer required expensive or ugly cabling. Business users could get up out of their chairs and sit in the sunshine while they worked. New generations of handheld devices allowed users access to stored data as they walked down the hall to a meeting. The dawn of networking elegance was upon us. Users could set their laptops down anywhere and instantly be granted access to all networking resources. This was, and is, the vision of wireless networks, and what they are capable of delivering.
Fast forward to today. While wireless networks have seen widespread adoption in the home user markets, widely reported and easily exploited holes in the standard security system have stunted wireless' deployment rate in enterprise environments. While many people don't know exactly what the weaknesses are, most have accepted the prevailing wisdom that wireless networks are inherently insecure and nothing can be done about it. Can wireless networks be deployed securely today? What exactly are the security holes in the current standard, and how do they work? Where is wireless security headed in the future? This article attempts to shed light on these questions and others about wireless networking security in an enterprise environment.
In 1999 the IEEE completed and approved the standard known as 802.11b, and WLANs were born. Finally, computer networks could achieve connectivity with a useable amount of bandwidth without being networked via a wall socket. Suddenly connecting multiple computers in a house to share an Internet connection or play LAN games no longer required expensive or ugly cabling. Business users could get up out of their chairs and sit in the sunshine while they worked. New generations of handheld devices allowed users access to stored data as they walked down the hall to a meeting. The dawn of networking elegance was upon us. Users could set their laptops down anywhere and instantly be granted access to all networking resources. This was, and is, the vision of wireless networks, and what they are capable of delivering.
Fast forward to today. While wireless networks have seen widespread adoption in the home user markets, widely reported and easily exploited holes in the standard security system have stunted wireless' deployment rate in enterprise environments. While many people don't know exactly what the weaknesses are, most have accepted the prevailing wisdom that wireless networks are inherently insecure and nothing can be done about it. Can wireless networks be deployed securely today? What exactly are the security holes in the current standard, and how do they work? Where is wireless security headed in the future? This article attempts to shed light on these questions and others about wireless networking security in an enterprise environment.
Infranet
An increasing number of countries and companies routinely block or monitor access to parts of the Internet. To counteract these measures, we propose Infranet, a system that enables clients to surreptitiously retrieve sensitive content via cooperating Web servers distributed across the global Internet. These Infranet servers provide clients access to censored sites while continuing to host normal uncensored content. Infranet uses a tunnel protocol that provides a covert communication channel between its clients and servers, modulated over standard HTTP transactions that resemble innocuous Web browsing. In the upstream direction, Infranet clients send covert messages to Infranet servers by associating meaning to the sequence of HTTP requests being made. In the downstream direction, Infranet servers return content by hiding censored data in uncensored images using steganographic techniques. We describe the design, a prototype implementation, security properties, and performance of Infranet. Our security analysis shows that Infranet can successfully circumvent several sophisticated censoring techniques.
An increasing number of countries and companies routinely block or monitor access to parts of the Internet. To counteract these measures, we propose Infranet, a system that enables clients to surreptitiously retrieve sensitive content via cooperating Web servers distributed across the global Internet. These Infranet servers provide clients access to censored sites while continuing to host normal uncensored content. Infranet uses a tunnel protocol that provides a covert communication channel between its clients and servers, modulated over standard HTTP transactions that resemble innocuous Web browsing. In the upstream direction, Infranet clients send covert messages to Infranet servers by associating meaning to the sequence of HTTP requests being made. In the downstream direction, Infranet servers return content by hiding censored data in uncensored images using steganographic techniques. We describe the design, a prototype implementation, security properties, and performance of Infranet. Our security analysis shows that Infranet can successfully circumvent several sophisticated censoring techniques.
Wireless Security Auditor (WSA)
WSA is an IBM research prototype of an 802.11 wireless LAN security auditor, running on Linux on an iPAQ PDA. WSA automatically audits a wireless network for proper security configuration, to help network administrators close any vulnerabilities before the hackers try to break in. While there are other 802.11 network analyzers out there (wlandump, ethereal, Sniffer), these tools are aimed at protocol experts who want to capture wireless packets for detailed analysis. WSA is intended for the more general audience of network installers and administrators, who want a way to easily and quickly verify the security configuration of their networks, without having to understand any of the details of the 802.11 protocols.
WSA is an IBM research prototype of an 802.11 wireless LAN security auditor, running on Linux on an iPAQ PDA. WSA automatically audits a wireless network for proper security configuration, to help network administrators close any vulnerabilities before the hackers try to break in. While there are other 802.11 network analyzers out there (wlandump, ethereal, Sniffer), these tools are aimed at protocol experts who want to capture wireless packets for detailed analysis. WSA is intended for the more general audience of network installers and administrators, who want a way to easily and quickly verify the security configuration of their networks, without having to understand any of the details of the 802.11 protocols.
Monday, August 19, 2002
MS Windows 2000 TCP/IP Implementation Details
This white paper describes the Microsoft® Windows® 2000 operating system
TCP/IP implementation details, and is a supplement to the Microsoft Windows 2000 TCP/IP manuals. The Microsoft TCP/IP protocol suite is examined from the bottom up. Throughout the paper, network traces are used to illustrate key concepts. These traces were gathered and formatted using Microsoft Network Monitor, a software-based protocol tracing and analysis tool included in the Microsoft Systems Management Server product. The intended audience for this paper is network engineers and support professionals who are already familiar with TCP/IP.
This white paper describes the Microsoft® Windows® 2000 operating system
TCP/IP implementation details, and is a supplement to the Microsoft Windows 2000 TCP/IP manuals. The Microsoft TCP/IP protocol suite is examined from the bottom up. Throughout the paper, network traces are used to illustrate key concepts. These traces were gathered and formatted using Microsoft Network Monitor, a software-based protocol tracing and analysis tool included in the Microsoft Systems Management Server product. The intended audience for this paper is network engineers and support professionals who are already familiar with TCP/IP.
Friday, August 16, 2002
Incident Handling Steps
The response to systems security incidents is as, if not more, important as detection. What actions you perform subsequent to identifying an incident will not only affect your organization's operations, but may impact future such procedures, your security posture, and the outcome of the situation.
This article covers the topic of response, including matters of scale, operational constraints, appropriate countermeasures, legal concerns, and hints for proper implementation. While not technical in nature, this study of response procedures might give you some insight on how to handle the more ambiguous elements of systems security: human factors, policy, and time.
The response to systems security incidents is as, if not more, important as detection. What actions you perform subsequent to identifying an incident will not only affect your organization's operations, but may impact future such procedures, your security posture, and the outcome of the situation.
This article covers the topic of response, including matters of scale, operational constraints, appropriate countermeasures, legal concerns, and hints for proper implementation. While not technical in nature, this study of response procedures might give you some insight on how to handle the more ambiguous elements of systems security: human factors, policy, and time.
Bait and Switch Honeynet
The idea of a "Bait and Switch" honeynet is to use an otherwise passive security mechanism as a defensive security layer.
A would-be attacker sends an exploit to your production server. Snort picks this up and sends an alert. A series of bash scripts -- probably using swatch -- picks up this alert, understands that it is a serious alert, and takes action. The action taken is to redirect iptables port-forwarding rules from your production machine to a honeynet machine on another network or subnet (isolated from production at any rate). (Note: only traffic from the hostile IP should be diverted. Everything else still goes to production.) This honeynet machine has the following characteristics: It is not normally accessible from the outside world -- only when the Bait and Switch system kicks in. Secondly, it should look -- on the surface -- as much like your production machine as possible. It should not contain any sesitive data, database access, etc. While you dont want the attacker to realize that he's been switched before he gives up attacking - if it had compromisable information, it wouldn't be a honeynet eh? There are some timing issues with this, but they are acceptable for these purposes. For example, a single packet ftp root-level exploit may succeed, but if traffic is diverted to the honeynet immediately after, the attacker will never realize it succeeded and would not have access to the machine to take advantage of the exploit anyway.
The idea of a "Bait and Switch" honeynet is to use an otherwise passive security mechanism as a defensive security layer.
A would-be attacker sends an exploit to your production server. Snort picks this up and sends an alert. A series of bash scripts -- probably using swatch -- picks up this alert, understands that it is a serious alert, and takes action. The action taken is to redirect iptables port-forwarding rules from your production machine to a honeynet machine on another network or subnet (isolated from production at any rate). (Note: only traffic from the hostile IP should be diverted. Everything else still goes to production.) This honeynet machine has the following characteristics: It is not normally accessible from the outside world -- only when the Bait and Switch system kicks in. Secondly, it should look -- on the surface -- as much like your production machine as possible. It should not contain any sesitive data, database access, etc. While you dont want the attacker to realize that he's been switched before he gives up attacking - if it had compromisable information, it wouldn't be a honeynet eh? There are some timing issues with this, but they are acceptable for these purposes. For example, a single packet ftp root-level exploit may succeed, but if traffic is diverted to the honeynet immediately after, the attacker will never realize it succeeded and would not have access to the machine to take advantage of the exploit anyway.
Network Sniffers explained
Sniffers are tools, also known as network analyzers, used for monitoring network traffic. As such, if used by authorized personnel, can prove to be of a great value. But, on the other hand, sniffers represent significant threat to your network, and are very hard to detect.
Why a threat, one might wonder? Sniffers do not pose as a direct threat to your data in the common sense of the word, like viruses or malicious code. No, the threat lies in the fact that sniffers are network analyzers designed to monitor network traffic. A high level of risk lies within the abuse of sniffers, due to the fact that an attacker, or a hostile user can gather information that travels through the network, sensitive information like passwords, various confidential information and similiar, stored in plain text or other formats. Usually, the presence of a sniffer on the network can indicate future, more serious attacks against the network. Information gathered through the usage of sniffers can be used for upcoming attacks, further network compromises and can lead to a complete data disclosure and network compromise. So, it's of a great value to recognise the risks posed by network sniffers.
If you want to test your network, and try out some sniffers and their features, I'd advise you to try the following ones: Ethereal, available for both Unix/Linux and Windows or Sniffit, a Unix/Linux only tool. Of course, there are others, all flavours included, GUI or promp
Sniffers are tools, also known as network analyzers, used for monitoring network traffic. As such, if used by authorized personnel, can prove to be of a great value. But, on the other hand, sniffers represent significant threat to your network, and are very hard to detect.
Why a threat, one might wonder? Sniffers do not pose as a direct threat to your data in the common sense of the word, like viruses or malicious code. No, the threat lies in the fact that sniffers are network analyzers designed to monitor network traffic. A high level of risk lies within the abuse of sniffers, due to the fact that an attacker, or a hostile user can gather information that travels through the network, sensitive information like passwords, various confidential information and similiar, stored in plain text or other formats. Usually, the presence of a sniffer on the network can indicate future, more serious attacks against the network. Information gathered through the usage of sniffers can be used for upcoming attacks, further network compromises and can lead to a complete data disclosure and network compromise. So, it's of a great value to recognise the risks posed by network sniffers.
If you want to test your network, and try out some sniffers and their features, I'd advise you to try the following ones: Ethereal, available for both Unix/Linux and Windows or Sniffit, a Unix/Linux only tool. Of course, there are others, all flavours included, GUI or promp
Thursday, August 15, 2002
Speak Freely for Windows and UNIX
Speak Freely is a program for 80x86 Windows machines and a variety of Unix workstations which lets you talk to other people across a local network or (with a fast enough link or enough compute power to compress and decompress audio in real time) the Internet. Optional party-line support and data compression are available, using the algorithm employed by GSM digital cellular telephones to reduce bandwidth requirements to 1700 characters per second. Sound packets can be encrypted with IDEA, DES, a binary key supplied in a file, or any combination. Speak Freely cooperates with a copy of PGP installed on your computer to automatically exchange session keys with users on your public keyring. Windows and Unix machines can intercommunicate, and Speak Freely can communicate with other Internet voice programs which support RTP or VAT protocol.
Speak Freely is a program for 80x86 Windows machines and a variety of Unix workstations which lets you talk to other people across a local network or (with a fast enough link or enough compute power to compress and decompress audio in real time) the Internet. Optional party-line support and data compression are available, using the algorithm employed by GSM digital cellular telephones to reduce bandwidth requirements to 1700 characters per second. Sound packets can be encrypted with IDEA, DES, a binary key supplied in a file, or any combination. Speak Freely cooperates with a copy of PGP installed on your computer to automatically exchange session keys with users on your public keyring. Windows and Unix machines can intercommunicate, and Speak Freely can communicate with other Internet voice programs which support RTP or VAT protocol.
Pseudorandom Number Sequence Test Program
This page describes a program, ent, which applies various tests to sequences of bytes stored in files and reports the results of those tests. The program is useful for those evaluating pseudorandom number generators for encryption and statistical sampling applications, compression algorithms, and other applications where the information density of a file is of interest.
This page describes a program, ent, which applies various tests to sequences of bytes stored in files and reports the results of those tests. The program is useful for those evaluating pseudorandom number generators for encryption and statistical sampling applications, compression algorithms, and other applications where the information density of a file is of interest.
MAC Addressing and ARP Functionality
The following paper will be on learning the usefulness of the MAC address and the inner workings of the Address Resolution Protocol on an Ethernet network.
The following paper will be on learning the usefulness of the MAC address and the inner workings of the Address Resolution Protocol on an Ethernet network.
Wednesday, August 14, 2002
TRACING AN IP (Internet Protocol)
In here I have figure out some very easy but cool ways to trace out the geographical location and various other infos like ISP details etc of a remote computer using its IP.
In here I have figure out some very easy but cool ways to trace out the geographical location and various other infos like ISP details etc of a remote computer using its IP.
Tuesday, August 13, 2002
Introduction to Denial of Service
In this paper I have tried to answer the following questions:
- What is a denial of service attack?
- Why would someone crash a system?
- How can someone crash a system.
- How do I protect a system against denial of service attacks?
In this paper I have tried to answer the following questions:
- What is a denial of service attack?
- Why would someone crash a system?
- How can someone crash a system.
- How do I protect a system against denial of service attacks?
Thursday, August 08, 2002
Research Electronics International
Research Electronics International specializes in the design and manufacture of electronic countermeasure equipment.
Research Electronics International specializes in the design and manufacture of electronic countermeasure equipment.
SSL Tunneling
SSL stands for Secure Socket Layer. The 'Secure' implies an encryption, while Socket Layer denotes an addition to the Window Socket system, Winsock. For those that don't know, a Socket is an attachment to a port on a system. You can have many sockets on one port, providing they are non-blocking (allowing control to pass through to another socket aware application which wishes to connect to that port).
A Secure Socket Layer means that any sockets under it, are both secure and safe. The idea behind SSL was to provide an encrypted, and thus, secure route for traffic along a socket based system, such as TCP/IP (the internet protocol). Doing this allows security in credit card transactions on the Internet, encrypted and protected communiqué along a data line, and overall peace of mind.
SSL stands for Secure Socket Layer. The 'Secure' implies an encryption, while Socket Layer denotes an addition to the Window Socket system, Winsock. For those that don't know, a Socket is an attachment to a port on a system. You can have many sockets on one port, providing they are non-blocking (allowing control to pass through to another socket aware application which wishes to connect to that port).
A Secure Socket Layer means that any sockets under it, are both secure and safe. The idea behind SSL was to provide an encrypted, and thus, secure route for traffic along a socket based system, such as TCP/IP (the internet protocol). Doing this allows security in credit card transactions on the Internet, encrypted and protected communiqué along a data line, and overall peace of mind.
Secure Sockets Layer or SSL Torn Apart
Secure Sockets Layer or SSL is a secure protocol, which is the reason why secure E-Commerce and E-Banking is possible. It has become the de facto standard for secure and safe only transactions. When Netscape first developed SSL, the main aim or motive behind it was to ensure that the client and host can communicate or transfer data and information securely.
What SSL does in short would be, encrypt data at the sender’s end and decrypt data at the receiver’s end. This encrypted data cannot be picked up or hijacked in between and any tampering would not only be very difficult, it would easily be detected. Not only that, SSL also provides for two-way authentication i.e. verification of the client’s and the server’s identity.
Secure Sockets Layer or SSL is a secure protocol, which is the reason why secure E-Commerce and E-Banking is possible. It has become the de facto standard for secure and safe only transactions. When Netscape first developed SSL, the main aim or motive behind it was to ensure that the client and host can communicate or transfer data and information securely.
What SSL does in short would be, encrypt data at the sender’s end and decrypt data at the receiver’s end. This encrypted data cannot be picked up or hijacked in between and any tampering would not only be very difficult, it would easily be detected. Not only that, SSL also provides for two-way authentication i.e. verification of the client’s and the server’s identity.
Introduction to Denial of Serivice
In this paper I have tried to answer the following questions:
- What is a denial of service attack?
- Why would someone crash a system?
- How can someone crash a system.
- How do I protect a system against denial of service attacks?
In this paper I have tried to answer the following questions:
- What is a denial of service attack?
- Why would someone crash a system?
- How can someone crash a system.
- How do I protect a system against denial of service attacks?
Wednesday, August 07, 2002
Next-Generation Win32 exploits: fundamental API flaws
This paper presents a new generation of attacks against Microsoft Windows, and possibly other message-based windowing systems. The flaws presented in this paper are, at the time of writing, unfixable. The only reliable solution to these attacks requires functionality that is not present in Windows, as well as efforts on the part of every single Windows software vendor. Microsoft has known about these flaws for some time; when I alerted them to this attack, their response was that they do not class it as a flaw - the email can be found here. This research was sparked by comments made by Microsoft VP Jim Allchin who stated, under oath, that there were flaws in Windows so great that they would threaten national security if the Windows source code were to be disclosed. He mentioned Message Queueing, and immediately regretted it. However, given the quantity of research currently taking place around the world after Mr Allchin's comments, it is about time the white hat community saw what is actually possible.
This paper is a step-by-step walkthrough of how to exploit one example of this class of flaw. Several other attack methods are discussed, although examples are not given. There are many ways to exploit these flaws, and many variations on each of the stages presented. This is just one example.
This paper presents a new generation of attacks against Microsoft Windows, and possibly other message-based windowing systems. The flaws presented in this paper are, at the time of writing, unfixable. The only reliable solution to these attacks requires functionality that is not present in Windows, as well as efforts on the part of every single Windows software vendor. Microsoft has known about these flaws for some time; when I alerted them to this attack, their response was that they do not class it as a flaw - the email can be found here. This research was sparked by comments made by Microsoft VP Jim Allchin who stated, under oath, that there were flaws in Windows so great that they would threaten national security if the Windows source code were to be disclosed. He mentioned Message Queueing, and immediately regretted it. However, given the quantity of research currently taking place around the world after Mr Allchin's comments, it is about time the white hat community saw what is actually possible.
This paper is a step-by-step walkthrough of how to exploit one example of this class of flaw. Several other attack methods are discussed, although examples are not given. There are many ways to exploit these flaws, and many variations on each of the stages presented. This is just one example.
Tuesday, August 06, 2002
Security pros develop flaw database
A broad group of hackers and security experts have banded together to create a new service that assembles information on vulnerabilities, security tools and bug-related discussions.
A broad group of hackers and security experts have banded together to create a new service that assembles information on vulnerabilities, security tools and bug-related discussions.
Snort on Windows 98/ME/NT4/2000
This documentation will hopefully help you to install Snort on your Win32 box. It will also help you install Snort as a service (Only available on NT4 and 2000), install MySQL as a database, and Acid to view your alert file that Snort will create.
This documentation will hopefully help you to install Snort on your Win32 box. It will also help you install Snort as a service (Only available on NT4 and 2000), install MySQL as a database, and Acid to view your alert file that Snort will create.
Subscribe to:
Posts (Atom)
