Infosec - AnShLv

A new Linux/Unix based systems vulnerability has been discovered, it became open to public last week. Today most systems on the Internet are vulnerable including servers, routers, computers, laptops, IP cameras, etc. Anywhere bash command processor is being used. Though the problem exists for last 25 years, it was unknown before.

There are two ways to check if your system is vulnerable.

Run the following using your bash interpreter:

env X="() { :;} ; echo Vulnerable" bash -c "echo ScriptFinished"

To check all recent vulnerabilities you can use this script: https://github.com/hannob/bashcheck

Once the issue is found on your system, you can update your bash version or apply patches, else wait for vendor updates.

Recently I've had a chance to configure the APC's UPS device providing 4200 Watts of backup energy to my server and other equipment.

The story is about Smart UPS 6000 XLI. I was extending it with one more battery pack, consisting of four 18 kilogram batteries. As the manual says, I should program the added the battery pack in UPS configuration for it to act properly and count remaining time well. Considering manual, that was easy. Eventually I discovered that manual does not correspond the software I was connecting to via the serial cable at all. After nearly eight hours of trial and error I discovered I do not have that useful feature neither over the serial console, nor using the web interface of remote management card.

So I called the support of UPS and asked them (I had to do that in Russian, as support belongs to Moscow and does not care I would like to speak Ukrainian, they just have one support center for two countries). Anyway, I asked how do I mention the number of batteries in this device. They told - you just go to UPS tab on web-interface and do it. Strange that manual did not tell a thing about this, but I have already been there and there was no such option - I told.

The support girl got surprised and told I would need to flash the remote control card. She sent me instructions how to and files I need to get flashing done. As I was doing the procedure under Linux, I referred to flashing over ftp.

The software consists of three binary packages and I managed to upload two and flash two thirds of the software. The third part - so called application, failed to come in, no matter how I tried. So I ended up with half-responsible terminal with no more information about UPS and it's status, as well as broken web-interface.

I read on the web, the solution could be to format and reboot the card. I did it, and lost all connection to the card. I thought I killed it.

I wrote email in response about the situation to the girl I talked with, but got no response, so was left on my own.

After a couple hours of thinking, I changed the port speed from recommended 2400 to standard 9600 on the COM port and it came alive.

At last, when the card came alive, I called support once more, and a guy, hardly understanding me (or unwilling to understand), said to complete the flashing I need to swap the order of files I am uploading. My words about the manual sent by girl and the order mentioned there were not heard. - Just change the order, he said. Or try to flash the card over X-Modem, find how at our site (he meant APC). - Oh no, they aren't at the site, I will send you, told he in a minute.

After I received his e-mail I got shocked of the procedure complexity. I just closed the message and started thinking how to flash the old way. I was not physically near the server and this procedure would make me pull the cables and plug them back, simultaneously doing other strange voodoo things. I trusted the logic, that no one would play this way.

Again after searching Internet for one more hour, I discovered some people enter "bin" command before flashing. I guessed I need to transfer ftp client to binary mode beforehand for this to work. When I did the trick, the device got flashed over FTP and using web interface I saw the long struggled option to select number of batteries and many more at the UPS tab.

Usually, when I wish to add a person whose e-mail I do not know, I cannot do it on LinkedIn because of very prohibitive policy, used by the network.

It may seem, LinkedIn does it's best to protect privacy of their users. But does it in fact?

On Sunday, September 2, I logged into my account and the system proposed me to add many people I might know, who it found in my mailbox, while I did not allow it to enter any of my mailboxes recently.

That means the network stores once received log in data and reuses it on regular bases. Even more interesting - after I chose who do I send invitations to, while being quite surprised how the system behaves, I saw all my numerous invitations to generally unfamiliar people were successfully sent.

That was not the case yet. Next I got a list of nearly 12 people I might want to invite joining LinkedIn (again from my e-mail). I unchecked 11 of them and sent invitation to just one. After receiving confirmation about over 1000 invitations sent, my eyes slightly increased in size.

In fact there was a scroll, which you could even not notice if you use web fast and do not expect such things from well-known services.

To say the truth, LinkedIn is spamming with just no efforts to prevent it. Just doing it's best to promote itself among people I have ever communicated to during my life.

In the modern electronic word your mailbox is the identity of you. Whenever you lose passwords, access to services - you retrieve your password, or renew it using the e-mailbox.

Same way, you are not present on the web, until you register a mailbox.

It has been long since e-mail was introduced, and today it is still a key service to identify people.

I analyzed why do we still need e-mail, and decided - it is the most guaranteed way on the web to contact a concrete person. While this is a big question as to how often does person check his/her mailbox, also emails often change so we can not really track them. This way identities often get lost.

The next logical step would be using the sole identification by social networks, as by definition this is your second, digital "you", which usually is more stable and less changeable. Also it is far easier to renew.

The idea is not everyone wants to be public. I suppose, some shadow social networks profiles must be introduced by major social networks. Then every such profile would get a numerical id, using which the person could be still reached, not disclosing any personal data to the sending service. Also the number would have to be centrally-assigned and unchangeable.

This way the network, hosting your personal profile would be responsible for keeping track of you and assuring you will still be reached at the same id for a lifetime.

Metropolitan Police Central E-crime Unit (PCeU), as well as suppliers HP and KPMG support the training with 30 people selected for a five-day training. Cyber security professionals will teach amateurs about cyber security. Students were selected in the Cyber Security Challenge competition being held since April.

This is a first camp of a kind, and, if successful, these will become regional camps at local universities specializing in computer science and cyber security.

You will be missing times, when you had your own files at the laptop and did not worry someone can forbid access to them. Or easily steal them. There were spyware and viruses, but if experienced, you could be sure nothing goes that wrong.

Tomorrow you will make hard use of cloud services, and eventually your life will travel to foreign "clouds" of web servers. Whether business or personal, not you will control your data, but... Your most secure in the world provider - is it Google or anyone else.

Do you remember one told, the World War III will fire when someone pulls the cord out of the socket? No need now. They can just block files and data of all business and personal scopes, then tell - you do this, or will never get your info back.

As you see, any too much centralized system is not good. I suppose Google has already overcome the point of no-return. It has too much finances, powers and monopoly to just electronically rule the world, buy smaller companies and eventually become the one "cloud" for all world's data.

I am looking for my first smartphone. I read some reviews and decided to take HTC One S if it wasn't that much expensive and big.

Meanwhile, being a security person, I understand how much danger is posed by any mobile computing devices, able to communicate not only with Internet, but with Google's headquarters (in case of Android ones). This way you not only allow to spy on your phone contacts, but on your location, phone conversations, SMS messages and camera pictures.

Recently I had been developing HTML5 and CSS3 markup along with JQuery. May I be not the only person who thought "why?". You also might notice I did not have neither time nor desire to blog during that period.

There are many companies, developing their brand new sites. It includes the redesign, total re-creation and much more. I suppose, don't get me wrong, but the most inefficient task in the modern web is site creation.

We usually spend time and money just to mess with nice graphics and a bunch of scripts or CMSes, usually with no idea about what does it bring.

The technology often takes over the aim. Aim is to simplify access to information. That is why we use Google so much, and that is why, if we could, we would never visit a single site.

We aren't searching for beauty, nor having time for it if accidentally found in this mega fast world. We just get surprised and annoyed with - oh, one more site. We do not notice - oh, that is admiring, how it simplified my life.

That is why the more often I browse or develop the web, the more often I wish to change this. I mean simple things are truly genial. Just remember Linux.

I also feel the beauty of those sites, which allow me to guess where the most essential parts of the site are in a few seconds. And this is what I am searching for. The most exciting moment comes when I find the information I was looking for in just a few clicks.

Maybe we have come up to the moment when content really over-weights the form, usability overcomes complexity and speed takes over exploration?

I am working at the project, which would revolutionize the way we work on web and it is http://lackedit.com

I also think about the project to reinvent site building and it yet has no url.

Jacob Appelbaum, hacker, former Wikileaks volunteer recently told not to register on Facebook if you do not wish surveillance organized on you. He admitted, you will give out sensitive information even without your consent - if you have even a couple of friends who may tag you on pictures.

To be even more precise, even if you do NOT register, you might be tagged - but that is just another part of story.

Also Jacob says, Facebook is the greatest database of Jews, leftists, right wing people and anyone else in the world, who may be targeted one day after the governmental change.

Today we face popularity of QR-codes. Most tech-savvy people already actively use them to transfer encoded digital information into their devices, to follow links and to  input data into their devices with no manual typing.

Some inventive "hackers" already started using this technique by sticking false QR-codes over real ones. So in case you use code-recognition client, which is automatically following links, and your Android phone does not ask you before installing apps other than those from Android market, you are in trouble. Such QR-codes might drive you to the download of a false operating system update, being a virus.

This beautiful sunny day in Bielorus tends to be the final step about cutting off the Internet by the country's borders. Now most worldwide resources, host providers and everyone else in the world, ever benefiting from *.by zone traffic will suffer clients loss. The President of Bileorus, Aleksandr Lukashenko introduced a law, penalizing everyone, who will access foreign servers for almost $100. Today this law enters into force.

On the other hand, in Ukraine, which is neighboring Bielorus people expect the same situation, as both countries present strong dictating regimes. Just Lukashenko's one is more perfected. Seems, Europe will allow this to happen, seemingly not realizing the new USSR is going to be established.

I have heard many "safe" and "dangerous" stories about Skype. Being confused as to what I should believe in, I opened Google and understood two things right immediately. These are concerns about Skype:

1) Is your VoIP data secure with it;

2) Is all other data you own, secure, when Skype is installed at your device.

Considering the first, company is hardly trying to convince, that it is. Looking for the latter was a little trickier.

Recently a group of researchers at NYU Polytechnic Institute found out the fact - when you call a person on Skype, you can discover his/her IP address, even if the person doesn't "pick the headset up". There's also a possibility to define which torrents are active at the target PC, and ability to track how one moves from point to point without any permission.

Still one more thing left unsolved in identification aspect of the Web. How do you prove, the person, sitting in front of the monitor is that very same she claims to be? I personally thought about it before, and today Defence Advanced Researh Projects Agency (DARPA) decided to solve this finally. They would identify a "digital signature" or "digital fingerprint" based on your habits of mouse usage or the way person normally types.

Now algorithms are going to be developed with the help of scientists, who are invited to send their proposals.

Active Authentication industry day on Nov. 18 is to encourage industry to submit authentication proposals. Proposed research should investigate innovative approaches that enable revolutionary advances in science, software, or systems in the areas related to determining the identity of the individual at the keyboard.

infosecurity-magazine.com

Have recently read the new video of Madonna gone for web before the final release. And this was a demo-version, which raised a great tsunami of discussing on Twitter and other social places of the web.

I came up to the conclusion, leakage promotion techniques is a great way to reload the interest for some artist or public person on purpose. Especially when it is far too low.

Another leaks from Sweden remind us not to use one password at every site. They again do. But we continue to ignore.

Details of 210,000 Swedes - politicians and media figures, have been exposed to the Internet, which affected one person among 50 unaffected. That is called the greatest security breach in history of Sweden.

Once told, there's no personal life today any more, came true and will never roll back again.

Saw cheap IPhone 5 today at the electronics market. Fashion rules, no doubt, and everyone wants the toy. Even though the 5-th even doesn't exist yet. Strange feeling to witness the ghost.

I expanded my network of InfoSec specialists, analysts and geeks on Twitter. And got hinted to look at owasp.org project. I usually have numerous tabs open in Firefox, never timely reading them - so they grow. Now I have a couple more, promising myself to read them asap. We talked about ghosts, right? They say companies are divided into those which do know their web applications code is insecure and those which don't.

This ghost chasing is rated well in OWASP's top 10 rating of threats your company (and probably you) face during web information exchange.

Here is the link to the 2010 document. It appears, not much changes over time, so they don't update the rating annually. Still it is very current, being reviewed by some top companies from the industry recently. 

http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202010.pdf

Facebook has revealed a security system called FIS (Facebook Immunity System). FIS controls every read-write action of each user on the social network. This defends 99% of Facebookers from spam, as stated by Facebook itself. The defense system happens to be the biggest in the world, equipped with 30 supervisors, enabled to learn and take actions on noticing suspicious behavior patterns.

The system, as it seems to me, is still far from the artificial intelligence. But is already able to combat massive viral script attacks within the network by blocking messages based on keywords once found and identified in spam chat messages.

Still unknown techniques make the system vulnerable. Social bots tend to fool the system, even adding thousands of friends and harvesting sensitive data like e-mail addresses. Due to peaking number of friend rejections spam bots receive, Facebook predicts improving FIS based on higher, than usual rejections amount.

I personally recently found out Facebook controls the speed of friends addition, if you add them too fast - you get considered to be a bot, even if you just re-add known people to the newly created account. If some people reject you, you already get blocked for a couple days, or a week without even a guess, who did it.