Comments

Gabriel • September 9, 2011 4:43 PM

http://arstechnica.com/business/news/2011/09/researchers-typosquatting-snarfed-20gb-worth-of-fortune-500-e-mails.ars

Been waiting to post this. Apparently a very large amount of sensitive emails have typos in the domain name, such as a missing period. Researchers were able to amass over 20 gigs of data by registering doppelgänger domains with similar names to fortune 500 companies. One example: registering seibm.com, which is similar to IBM’s Swedish division subdomain, se.ibm.com.

kashmarek • September 9, 2011 5:52 PM

Google doctors +skype. I came across an article about doctors using Skype to meet with patients. Is this really a good idea? In particular, with Microsoft owning Skype and having a patent for recording VOIP calls. It would seem to put your medical information at risk. I doubt that Microsoft is covered by HIPAA in this circumstance. Find out from your doctor if his communications provider is covered by HIPAA.

Skippern • September 9, 2011 7:12 PM

@kashmarek: I work as a Chief Officer with medical reponsebilities on offshore support vessels, and having VOIP telephone contact with trained radio medics can in extreme cases be life saving for us. There is special VOIP software that allow us to connect medical equipment, such as EKG to it, and transfer live data to the doctors, as well as text, voice and video chat : sorrry dont remember name of software

A blog reader • September 9, 2011 9:57 PM

From Techdirt:

Wasn’t The PATRIOT Act Supposed To Be About Stopping Terrorism?
http://www.techdirt.com/articles/20110908/02534215846/wasnt-patriot-act-supposed-to-be-about-stopping-terrorism.shtml

In the book “50 Things You’re Not Supposed to Know 2” (The Disinformation Company Ltd., 2004), Russ Kick mentions instances where the USA Patriot Act was used in non-terrorism cases. Among other things, Mr. Kick asked the question as to why, if the USA Patriot Act powers were supposedly beneficial to society by facilitating law enforcement, were they promoted with an emphasis on preventing terrorism? (One could say that when trouble arises, it may be difficult to avoid using powers that are available, particularly if one is likely to be judged afterwards along the lines of “why didn’t you do such-and-such?”)

Also from Techdirt is an entry about a copyright case with a troubling implication: is it possible for a speaker, by recording what they are saying (and thus fixing it in a tangible form for the purpose of copyright) to prevent others from recording what they are saying by claiming copyright infringement?

http://www.techdirt.com/articles/20110901/23320615774/forget-wiretapping-laws-now-you-might-be-able-to-use-copyright-law-to-stop-anyone-recording-you-ever.shtml

On the issue of businesses and other parties looking out for suspicious activity, along with responses to instances of such activity, the following NPR article about counterterrorism systems at the Mall of America (in Minneapolis, Minnesota) may be of interest:

http://www.npr.org/2011/09/07/140234451/under-suspicion-at-the-mall-of-america

Clive Robinson • September 10, 2011 4:52 AM

@ Gabriel,

“Apparently a very large amount of sensitive emails have typos in the domain name, such as a missing period.”

You beat me to it because Bruce “squided” late this week and I’d “Gone for an early bath” [1] sometime before [2].

I’ve read the paper and it’s not exactly surprising, we’ve known about various forms of cyber squatting etc for years. The bigest surprise is the size of the problem near 30% of cases they found…

If you’d have asked me prior to their research I’d have put it down at a couple of percent at most. Mainly because of “company address books” taking the typing pain away from the short fat executive fingers.

I suspect there are many examples of security risk such as this that we realy devalue by an order of magnitude or more simply because we don’t see it from the correct perspective. Thus we end up undervaluing it and effectivly ignoring it because of our own prejudice rating (possibly) lower risk more technicaly chalenging risks as more worthy of our attention.

Unfortunatly the solution to this problem is going to get increasingly difficult as more and more execs move to “smart phones” for doing “always on working” where the stubby exec finger will cover six or more keys, and the distracted myopic vision could not see on the small screen a period “full stop” [3].

[1] It’s a Rugby term for saying “finished early, for a drink or three”. And for those who don’t know what Rugby is imagine a much faster game than American football oh and without all the silly body armour that actually increases the risk of getting injured.

[2] The UK is 6 hours ahead of “Bruce Blog time” (usually but not always 😉 and most when we can are having “social time” at 10:30PM on a Friday 😉

[3] A gentle attempt at humour, in England you will hear people say “You know he’s not going to do XXXX full stop” or “You cann’t do XXXX full stop” where the “full stop” emphasises the preceding statment to one of certainty or as an unavoidable and unquestionable command.

Clive Robinson • September 10, 2011 5:43 AM

@ Spellucci,

“Apple finally releases a DigiNotar security update”

Unfortunatly from what Apple has said it appears to only address the DigiNotar certificates,

http://support.apple.com/kb/HT4920

And very importantly it DOES NOT address the significant security vulnarability with the Keychain and EVSSL certificates.

The significant security risk on the Apple OS’s is that although a user might disable the root certificates of a CA, any EVSSL certs signed by the CA still remain valid, this is a major security fail.

So if another CA gets cracked and the attacker issues EVSSL certs (very very likely), even if the Apple user removes the CA root certs via the keychain the EVSSL certs will remain valid untill Apple issues another security update, which as many have noted they are a bit “tardy about”.

Clive Robinson • September 10, 2011 9:11 AM

@ Kashmarek,

“Google doctors +skype. I came across an article about doctors using Skype to meet with patients Is this really a good idea?… …It would seem to put your medical information at risk. I doubt that Microsoft is covered by HIPAA in this circumstance.”

Apparently according to “The Office of eHealth Standards and Services” at the CMS Headquarters in Baltimore Maryland Skype is compliant and have said,

“CMS does not advise on technology specific issues because the HIPAA [Privacy] Rule specifically allows for flexibility in the approach to safeguarding information…”

However the CMS are realy only talking about the encrypted sections of the Skype communications because the CMS also indicate that to be absolutely compliant,

A “covered entity” is required to produce a Risk Management Plan that clearly documents an entities understanding of the risks.

So at any nodes where Skype is not encrypted a risk analysis needs to be carried out. And even assuming end to end Skype Encryption both the “Doctor’s” and “Patients” PC’s would not be covered due to the likes of “shim malware” and “root kits” doing “end runs” around the application.

Oh and it’s not the CMS that prosecute but the Office of Civil Rights (OCR) who might just have a different viewpoint…

However from a doctors liability point of view the HHS and HIPAA is realy the least of their worries on this. First off are they actually covered by their liability insurance provider for this activity? Secondly what about local legislation (state etc)? Then of course if they do get sued it boils down to a duty of care with regards both a reasonable and best practice standard of medical care. If the injured parties legal eagles find just one example of somebody with a better risk analysis or implementation then it’s payout time.

The CMS of the HSS have a series of documents on HIPPA and the “Security Rule” see,

http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidance.html

(Drop the /rafinal…. to get links to the legislation)

It’s all a bit of a turgid read (as you’d expect).

e=mc2 • September 10, 2011 9:39 PM

Perhaps one day we will find squid pictures also in rock carvings.

It could well be an ancient forefather of Bruce who also was into…hmm…cryptology?…and wanted to communicate something about squids to others;-)

maeztro • September 11, 2011 4:48 AM

I have a catch-all email address set up for each of my domains. Scary the amount of email I receive meant for other people. And the few times I made the effort to try and help people, they just dispute with me the accuracy.

doctorhook • September 11, 2011 11:49 AM

Anybody seen this: http://nnsp.ucinne.cz/ ? It claims to be a key agreement system based on synchronized neural networks. Seems like it could work, although I can’t see the advantage over plain old Diffie-Hellman. (The fact that neither the web site nor the dissertation they reference mentions Diffie-Hellman seems like a bad sign.)

Clive Robinson • September 11, 2011 2:34 PM

@ doctorhook

“Seems like it could work, although I can’t see the advantage ove plain old Diffie-Hellman”

I’m going to have to have a good long think about it, but it gives me de ja vue feelings of that non quantum secret key exchange system using switched resistors in a circuit.

However people are looking for a way to replace various current algorithms just incase somebody gets quantum computing to a workable level.

Nick P • September 11, 2011 7:12 PM

@ Clive Robinson

I keep thinking about that snake oil vendor we had a few years back who used the key to produce a unique cipher and/or cipher+keycombo to hopefully defeat attacks. The cryptographers doubted his method because there could be cryptanalytic weaknesses. However, we may be able to improve on this idea to make an encryption scheme resistant to both quantum and classical attacks. It’s basically a combination of his different ciphers for different keys idea and the old encrypt with multiple algorithms idea.

In the past, I presented the idea of having about a dozen block ciphers & having bits sent with the key that tell which to use. This would mean attackers would have to try a dozen different cracking efforts on a given cipher text. Double or triple encryption could be used to prevent weakening of algorithms from being a problem. Essentially, you have E(key1, alg1, E(key2, alg2, E(key3, alg3, data))). They don’t know where to begin so they must try all kinds of combinations & the indirection may make that cost-prohibitive. It will definitely be inefficient on early to mid quantum computers with limited memory.

Truly random ciphers for every connection could cause serious performance issues. A less secure, but still robust, approach would be for each organization to use maybe 4 high performance ciphers or FPGA’s to accelerate whichever set of ciphers they choose. Using at least one high performance cipher, like Salsa20, can also help. An additional way might be to modify some of the internal numbers the ciphers use to operate in a way that doesn’t reduce security. Have several sets of constants that can be used, each counting as a different version of the algorithm, which allows to increase diversity via a small set of algorithms.

Note: For the life of me, I couldn’t find that company’s product in any of the Doghouse articles. Maybe it was a regular blog post. I still think they had the right concept & a horrible implementation strategy.

AC2 • September 12, 2011 1:20 AM

Apple has filed a patent to track users’ location data and tie that to physical stores to ‘improve’ local search ranking. This will work even when the phones are in sleep mode and without the user switching/ starting anything. You can, of course, ‘opt-out’….

The funniest part is:
“Apple explain that they will ensure anonymity by assigning users a unique ID number. The server which tracks and logs your location will only know the ID number and not your identity”…

WTF!

http://www.theregister.co.uk/2011/09/09/apple_patent_will_use_iphones_to_check_into_venues/

Another worthy read from the Reg, re impact of 9/11 on tech

http://www.theregister.co.uk/2011/09/10/how_september_11_changed_our_world/

and

http://www.theregister.co.uk/2011/09/11/9_11_ten_years_on/

Clive Robinson • September 13, 2011 4:12 AM

OFF Topic:

An item from The Register about APT and Botnets,

http://www.theregister.co.uk/2011/09/13/apt_botnet_symbiosis/

The basic argument is high end researchers working for Governments on APT have Zero-Days aplenty, but not the remote systems. Botnet herders have the remote systems but lack new zero-days to keep their ball rolling.

Thus the author sugests that a symbiosis has developed between the researchers and herders. In that, in return for herders providing access to the remote systems needed by the Government APT researchers, the researchers hand down zero-days that have “become known” in effect as a quid pro quo.

Thus while the targets high on the Government APT list (should) get patched fairly quickly those of small and medium style businesses take a lot longer and often home users not at all. Which alowes the botnet herders to “increase their flock” quite extensivly.

In effect the Government APT researchers have “out-sourced” the “fire and forget” aspect of target acquisition, to concentrate on “directed attack” of their chosen targets. The herders in return have (currently) little need of the targets high on the APT list.

What is happening is a variation on what I’ve been predicting for some time. The only difference being that most of the bot herders do not appear to have woken up to the real value of their flock. When they do we realy are going to start living in interesting times.

Clive Robinson • September 13, 2011 4:57 AM

OFF Topic:

As I have been laying around suffering the pain and nuisance of “the caring professions”, I’ve had the chance to think a little about malware and botnets and “facial recognition”.

One of the problems with being a botnet herder is you have a large resource at your disposal but aside from doing some quite trivial things it’s hard to capitalize on “your assets” in a way that does not destroy your assets (ie you get “patched out”).

The problem is you have a million pluss PC’s in your flock but apart from analysing their IP addresses in general you don’t have any idea what the majority are used for or by whom.

So the next sensible step as a herder is to get more information, that is use your malware to start doing an analysis of the PCs hard drives and network connections etc. Obviously systems for business use will usually have significant differences to those used by “home gamers” that can be easily spotted. But this is still not sufficiently specific to be usefull, you need a more indepth analysis.

For instance identifing the user of tthe particular PC. You might find letters and Emails that give a clue but how many “J. Smiths” out there?

Even on business machines people have a habit of putting on personal photos etc.

Now let us assume that your malware has the ability to trawl through the photos looking for the make and model etc of the camera to differentiate personal snaps from “celeb downloads”. And then does facial recognition through all the personal pictures it finds and then produces a list of the top ten (adult) faces.

It then uses the likes of Facebook (or other service with facial recognition and poor security) to find the names and other details about the PC user and/or their friends and family.

The use of such automated tools very much increases the value of the flock as it alows all sorts of “value added” information to be built up.

It might also find you the “Million Dollar Photo”. Many people do silly things irrespective of if they are famous or not, sometimes they get photographed doing it by friends and family or others in a social group. One such photo was taken at a fancy dress party where a member of the UK royal family was dressed like a WWII German Officer, the person who took the photo knew it had value but not how much. They sold it to a newspaper for about 10,000GBP however as a journalist publicaly acknowledged if the happy snapper had known what they were doing they could easily have got 25 times that.

Thus knowing not just who the user of a PC is but who their family, friends and others they are networked with socialy or proffessionaly has real value in some cases, the difficult bit is finding it out automaticaly and knowing what to do with it at the right time.

Clive Robinson • September 13, 2011 5:35 AM

@ Nick P,

“For the life of me, I couldn’t find that company’s product in any of the Doghouse articles. Maybe it was a regular blog post. I still think they had the right concept & a horrible implementation strategy.”

If it was the one where the person indicated that the system had been looked at and further considered by certain large government agencies then I vaguly remember it.

When chaining ciphers there are a few things you need to remember.

The first is that the number of maps [Ct = f(pt)] is limited by the block width in bits (W). That is it is just one of the permutation maps on two sets whos size N = 2^W, most of which are not very usefull cryptographicaly so a large block width is desirable. Secondly your various basic ciphers realy should be orthagonal to each other in their use of primatives in rounds. Thirdly like wheels in a rotor machine you are usually better off using all the ciphers and just permutating their order in the chain. Forthly don’t limit yourself to a simple chain, there is no reason why the oneway function in a round should not be another cipher (including a stream cipher), likewise the mixing function need not be just XOR, ADD or MUL, that is you could use your ciphers to make rounds not chains.

As you note sometimes you can change the internals of a cipher (sometimes not) some research on Sboxs in the past has sugested beyond just a few rounds random Sboxs offer very similar levels of security to selected Sboxs. Likewise changing the number of rounds is usefull. However some things cannot be changed without care such as multiplication in a field.

There is of course as you note the problem with “how many bits are in your key”, but to be honest in some communications it is only a small part of the overhead, however it does represent a delay on rekeying which might be a problem on sending the likes of video or audio. Thus your system might need to consider using an “evolving key”.

Clive Robinson • September 14, 2011 5:25 AM

OFF Topic:

Malware named Trojan.Mebromi (Boot.Mebromi)

Infects the MBR of the boot media, but also if you have an Award (now owned by Phoenix) FLASH BIOS chips it puts malware into the BIOS.

Thus once in the Award BIOS it can evade AV software even if run from a different boot media (because it’s effectivly embeded on the Motherboard). Once in place on an Award BIOS motherboard this particular bit of malware is going to be very difficult to get rid of for many people.

Symantec have a technical writeup on it,

http://www.symantec.com/connect/blogs/bios-threat-showing-again

As Symantec note this is not the first time this technique has been used but it’s been well over a decade since the previous BIOS overwriting malware.

It’s funny in a way because a few of us on this blog have been around a long time and have first hand experiance from the first time. And have discussed this attack vector befor and wondered why it was not being used… Well it is now.

And just to remind folks the BIOS chip is not the only FLASH chip in PC’s quite a few Graphics cards and Network cards have FLASH chips that get read during the boot process. Also remember “code signing” is by no means secure as the system can be subverted fairly easily as a number of people are only to aware.

As always the first line of defence is “preparedness” so it is worth finding out exactly what your Motherboard and other hardware is and the manufactures web pages and information on “re-flashing” the chips for firmware replacment/upgrades etc.

Clive Robinson • September 14, 2011 6:38 AM

OFF Topic:

As I mentioned above (13 Sept 4:57 AM) I’ve been thinking about information we leak inadvertantly by what we put on our computers and how others can make use of it in various nefarious ways.

Well as I had time on my hands waiting for the “caring proffession” to make use of their instruments of pain and discomfort on my spine, I did a little “online musing” and dug up an interesting article by Kevin Gold, which in turn gave rise to this article,

http://www.broadcastprojects.com/2011/09/05/ghosts-in-the-machine/

Which links to the Kevin Gold articale in Slate Magazine but also to a second artical by Chris Arkenberg which is also worth a read (if you can get past the slight “raving” tone).

Chris’s view is almost that we will become what our “smart device” says we are. If you like our smart phone will be what we currently expect (phone/email/web/etc) but with the inclusion of Near Field Communications devices a credit card, door key, memory of not just what we have purchased but where we have been when and by various measures what state we were in at the time.

Thus a time may well come when for most day to day activities we effectivly loose our identity to the smart device we hold. But worse it will become an “Orwellian witness” to our lives, where others will believe it in prefrence to our spoken word.

Thus if our smart devices are not properly secure (and these things never will be) they will become in skilled hands a “False witness” with all the consequences that entails…

Clive Robinson • September 16, 2011 10:47 AM

OFF Topic:

A new Forensic scanner for Windows PC’s that reconstructs much of the users online activity from the little snippets of Data Windows puts on the HD.

Called OWADE it was presented at BlackHat by Elie Bersztien,

http://m.elie.im/#/index.php?event=beyond-files-recovery-OWADE-cloud-based-forensic&type=talks

If it does even half of what is claimed for it then it’s a very usefull bit. of software not just for forensics but because it opens up some of those darker nooks and cranies of windows.

Clive Robinson • September 16, 2011 1:23 PM

OFF Topic:

RSA (a subsidury of EMC) who were subject to an APT attack recently that effected the security of their security tokens, (and as a consequence alowed an attack on a defence contracter,) recently held a “closed door” summit into APT.

It would appear APT attacks are rather more common than thought previously (no supprise there realy). Anyway some of the findings etc have become available on the Government Computing News (GCN) web site,

http://gcn.com/articles/2011/09/13/apt-attacks-a-fact-of-life.aspx?s=gcndaily_140911

One thing mentioned is the rise in “supply chain poisoning”, in the past there have only been a couple of cases get any attention. One was the addition of mobile phone devices to ePos terminals and another being Apple shipping ipods with PC malware on them. It is such an obvious attack vector that I’m quite surprised we don’t see a lot more of it.

Speaking of Apple and it’s less than wonderful security stance it would appear that a number of “security practitioners” think you should not run the server software or admin stuff on any network that can be accessed because the security is lamentable,

http://www.cio.com/article/689132/Mac_Desktop_Security_The_Landscape_Is_Changing_?source=CTWNLE_nlt_dailyam_2011-09-14

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.