Schneier on Security

Clive Robinson • November 9, 2011 9:10 AM

OFF Topic:

A simple question,

“How much is your identity worth?”

It’s an important question because it sets a bar on fraudsters using your ID fraudulently with various credit issuing organisations. (banks, card issuers, retail outlets, etc, etc).

Brian Krebs has been having a look around and it may surprise a number of people that effectivly all the required details on them are available for as little as half a dollar.

Now depending on who you beleive this info is worth around 10,000 dollars in fraud. So it is easy to see why various people would be interested in the potential profit…

http://m.krebsonsecurity.com/2011/11/how-much-is-your-identity-worth/

Clive Robinson • November 10, 2011 7:47 AM

@ David,

“what would you say to a Critical Infrastructure product vendor who in response to a vulnerability(with exploit code) said, “no, we have no intention of fixing it” but kept right on selling the product”.

Not much, I’d by product from another company in another country.

What you need to know is this is going to get a lot lot worse due to the US Government.

Basicaly they have decided that critical infrastructure computer based systems such as SCADA and their control consoles etc are “so critical” that knowledge of flaws by those other than in the private club they have set up is “verboten” thus you are required to inform them, but they are not required to inform anybody other than the chosen few and that does not include many of the equipment manufactures.

It is without a doubt stupidity of the highest order and as others have commented one likely reason is the stock pilling of vulnerabilities to be used against others…

Clive Robinson • November 12, 2011 8:10 AM

@ BF Skinner,

“Just say it man YOU’RE Q!”

My word might be my Bond, and yes I’ve designed quite a few little surveillance gadgets in my time (Including a Spread Spectrum bug that turned up in a photocpier in a well known seat of Government). But I’ve put that all behind me as the fun went out of it when the costs of semi-custom chips ment you could do most of it in an unmounted chip.

These days with SoC you can effectivly buy a “chip bugging device” as a standard part. I’m sure if you asked Robert T nicely he would give you some chip numbers you could get to play around with. With such parts comming on 1000+ reals for just a few thousand dollars and selling prices for those sorts of bugs in the +200 dollar price range your only real problem in making lots of money would be finding the customers.

@ Nick P,

“Whatever they can do before he snaps his fingers and they go “POOF!””

I’ve got BF thinking I’m a “Hippy Klingon”, and you thinking I’m “Gandalf”.

I know my hair and beard are getting a little long and bushy at the moment, but hey guys I still wear jeans and a tee shirt for working and a suit for the weekend (Thus I’m still “Agh ha, Staying alive, Staying alive” 😉

On another note you might find,

http://www.schneier.com/blog/archives/2010/12/brian_snow_sows.html#c623138

of interest, it was posted “November 11, 2011 4:03 PM”.

Clive Robinson • November 13, 2011 4:53 AM

@ Bruce, Nick P,

Not sure if I should put this hera or in the APT so I’ll post hear and cross link back.

One of the presenters at

F-Secure CEO Mikko Hypponen, one of the presenters at the Tokyo PacSec 2011 conferance, has indicated that the “China APT Mob” are almost certainly scapegoating China over the activities of other countries (which is a point I’ve been making for quite some time).

He has said that F-Secure have some evidence to support the view point due to the way the attacks are prosecuted.

http://mobile.itnews.com.au/Article.aspx?CIID=279623&type=News

Essentialy what Mikko Hypponen points out is that nearly all the attacks come in a very similar if not text book way,

1, User receives a very targeted Email.
2, The language used is effectively as expected.
3, The Email contains an attachment (usually PDF) again targeted at the user.

That is there is very little or nothing in the Email to arouse any suspicions in the user that the Email is anything other then genuine.

There are several implications to this.

Firstly the attacker has a lot of background material on the targeted user, which has been obtained from somewhere (possibly by examining the Email of the real person the Email impersonates).

Secondly the language used in the Email is almost exactly what would be expected of the person being impersonated, suggesting a very good command of both the language and current idioms and the field of endevor as practiced by the user.

As this is being done in over thirty languages, it is a remarkable feat if carried out by just one country alone. And one you would expect only from those who have been at it in other ways for a considerable time (ie the US, UK, Russia, France, Israel and other mainly Western Nations).

It is this asspect that Mikko Hypponen believes adds weight to the slowly growing evidence that other countries use China to mask their own targeted spy and espionage activities on the internet (this is not to say that China is by any means innocent but that they are not as the “China APT Mob” would have you belive the only ones).

Mikko’s recomendation is, as the Adobe Reader is the technical target of choice, not one I would generaly recomend which is to expunge it from all systems within an organisation.

There are several reasons why I’d normally say no to this sort of solution the two top ones being,

1, The attacker will try again with another technical target in short order, if it does not succeed with this one.

2, The disruptive effect on the business work flow would be excessive.

However this second point is as Mikko Hypponen points out mainly irrelevant with Adobe Reader.

Basicaly Adobe Reader is it’s own worst enemy being bloated, slow and historically full of easy exploits, whilst it’s many rival PDF viewers are generaly small, fast, and importantly do not have the exploits the attackers are using, whilst also being free to use across the majority of OS’s.

But that still leaves the first problem of other technical attack vectors using different software that is quite common, which the attackers can easily and quickly switch to. Put simply the attackers rate of fire is way way above the ability of the target to dodge so sooner rather than later a shot is going to hit the target and at that point it’s effectivly game over.

The solution to the problem is not the removal of a technical target, there are just way to many of them for this to be anything other than a very short term stop gap measure. It is to address the method by which the attack is delivered, specificaly to address the Trust issues involved with “invited inbound information” behind which these attacks operate.

None of these attacks would work if there was not a way for code to be executed by the user when they received it in their Email inbox. Thus plain text and no attachments would reduce the attack vectors to just those in a simple Email reader.

However this would significantly effect the ability of users to carry out their ordinary everyday work activities, many of which have become reliant on Email or web access as an “enabler”.

What appears to be needed as a first measure is a technical way by which trust could be established that the Email was genuinely from who it claimed to be.

However although this is currently fairly easily achievable if an organisation wishes to there are several problems,

1, It only establishes trust in one link of a very long chain.

2, Few Email readers actually handle the technical trust issues even remotly well enough.

Whilst the second issue is reasonably easily solved the first is not. It is quite likely that the attacker has already “owned” the impersonated persons computer in order to gather sufficient information to make the impersonation work, or has established themselves at some point in the communication path such as the MTA or router etc between the impersonated person and either the user under attack or some other user the impersonated person communicates with.

Thus the attacker has ample oportunity to move “up the chain” untill they find a weak link by which they can inject an attack to transverse down the chain to own the impersonated persons computer, by which point it is game over for the technical trust solution on the last link.

On the premise that no software is perfect, there will always be an opening for an attacker at some point. It also follows that many of these openings will be unknown for a period of time relating to how they get exploited (ie rise above the noise floor). Thus we will always have a window of opportunity for an attacker to get a toe hold by which they can with care exploit their way across many systems and networks. Thus it may not be possible to find a technical solution to the APT issue of “invited inbound information”, other than “don’t invite the information in”. Which in effect will give you a simple “air gaped” system, which is not terribly usefull for many activities these days.

Thus the ancient Chinese Curse has come of age and we are “living in interesting times”.