Scott Wright’s Security Views

In a fit of deja vu, I woke up to hear that Carleton University in Ottawa experienced a phishing attack of “tens of thousands of email messages” sent to email accounts related to the university.

http://www.cbc.ca/technology/story/2008/07/23/ot-carleton-080723.html?ref=rss
It’s not clear from the press release how the attackers got the email addresses, but in a June article on this site I outlined how this can happen due to inadequate controls on access to the directory server’s list of email addresses.

That article can be found at:

http://securityviews.com/blog/2008/06/20/the-first-steps-in-reducing-the-embarrassing-frequency-of-college-system-breaches/

The phishing site was a forged version of Carleton University’s web site, and was apparently quite a good replica. Ralph Michaelis, the university’s CIO, issued a notice to the university population that the institution never asks for the kind of information requested in these phishing messages when corresponding by email.

*** Techno-Geek Warning ***

The following lengthy article discusses technical details that may cause your head to explode. I take no responsibility for cleaning the walls after you read this.

************************

As promised, Steve Gibson has published his explanation of what Phorm Inc. is doing to enable “Behavioral Targeting” for its advertising network that leverages equipment it installs in ISP facilities for tracking and targeting ALL user web surfing.

Here are my three levels of interpretation, so you can choose to read further or not:

1. At the highest level, Phorm is enabling a more targeted marketing database that relies on analysis of your web requests, AND on the content of pages you view through a given ISP. The ISPs can make a lot of money from this model. Phorm claims that they do not store the information they see, and any profiling data about you is anonymized. If you trust them and your ISP, and don’t mind that they are doing this without your consent, you won’t see it as being much worse than what Double-Click does to profile you, except that they can see virtually EVERY site you visit, including the information going in and coming out. Continue Reading »

Two really good examples of why you should not ingnore insider threats popped up this week in Florida (click HERE) and in France (click HERE).

When an employee feels threatened by the organization or their management, you have to expect that they will at least consider using whatever leverage they have at their disposal. So, it’s best not to give them the wrong kind of leverage.

Continue Reading »

A year or two ago I was attending a session presented by a businessman who grew up in South Africa. He drew an interesting parallel between the wild baboons from his native land and the counter-productive habits of many businesses today.

It just so happens that the South African baboons have taken a liking to the corn that local farmers grow there. Apparently, they organize raids on the cornfields on a frequent basis. The farmers obviously aren’t too pleased with this. Moreover, the baboons don’t manage their situation very intelligently.

Continue Reading »

Bandaids are supposed to be used for first aid, not preventative maintenance. Here’s a good example of why you need to make security a priority early in the system design cycle.

Today I spent 45 minutes on my handsfree cell-phone while driving (and another 20 minutes on my home phone), helping a friend configure his new laptop PC to work with his wireless network. In the end, I don’t think Vista was actually the root of the connection problem, but it certainly didn’t help. I still don’t know why Vista can’t just recognize the wireless card, recognize the network and ask for the encryption key; then make the connection. It shouldn’t take more than a minute. As Bulldog Briscoe would say on the old “Frasier” sitcom, “This is crap! This is total BS!” Then he would thwak Bill Gates in the forehead with his knuckles… Continue Reading »

I think we all agree that powerful tools must be handled with care.

A nail gun is an invaluable tool for building houses, but would you let your kids, or even your office staff play with them? Definitely not, unless they have a reason to use nailguns (other than “for fun”), can demonstrate that they know how to use them without nailing themselves to the floor, and have at least read the handy reference manual, “Nailguns for Dummies”.

Michael Geist wrote about the power of Facebook (click HERE) and social networking sites in his self-described modest attempt to protest the Canadian government’s intent to pass reforms to federal copyright legislation this past month. Within a period of two weeks from starting it he watched his modest initiative snowball into a movement comprising 25,000 members on Facebook. This, together with independent efforts by others, apparently led the federal Industry Minister Jim Prentice to announce a delay in the proposed legislation.

Michael Geist must have felt something like Dr. Peter Venkman from Ghostbusters did after the first time the team tried to use their Proton Pack Beam to catch a ghost. So, how can such a great tool be dangerous? …Remember, “Important safety tip: Don’t cross the beams.” Continue Reading »

Not every breach is “Massive”. It can’t be. When you have limited resources you have to budget for security across the board. It occurs in every system that’s built. We do need to keep an eye on things and hold people accountable to correct problems, but when the media highlights these breaches using hyperbole it doesn’t help.

This case at Passport Canada (HERE), was clearly one that could have been prevented with a little more analysis and testing during the design and development cycle. But as far as I can tell, it was limited in its impact compared to the loss of thousands of citizens’ personal information when a laptop was stolen at Service Canada last month.

What went wrong?

According to the report, a citizen filling in the Canadian Passport application forms online decided to change the URL in his browser to see what would happen. By changing a character in the Address Line he was apparently able to see another person’s passport application containing all the private information collected during the process. The Globe and Mail newspaper headline reported “Passport applicant finds massive privacy breach”.

The Bottom Line

This type of problem is still serious, there is no question. It should not be allowed to happen. However, in the world of limited budgets for development and security testing, it is not unexpected that these kinds of problems happen.

There are certainly many points in a system development process where this type of problem should have been identified and fixed before going into operation, including:

• Security requirements phase - “URL manipulation by users should not them to see private information of other users
• Threat and Risk Assessment (TRA)- Identifying potential attacks and areas that require additional safeguards
• Security testing - Functional and infrastructure testing against the above security requirements, as well as penetration testing using tools designed to locate vulnerabilities

The reason I am not “shocked and appalled” at this breach is because it can not be classified as a “massive” privacy breach. A massive breach is one in which a single event causes a multitude of individuals’ private information to become compromised.

This is obviously a case of a reporter looking to make big headlines at the expense of a large system operator who has, in all likelihood done an adequate, if not excellent job securing the system as a whole. When this happens, security experts cringe because it tends to focus on the wrong areas when it comes to applying security resources in proportion to the importance of sensitive information and systems.
If you’d like to cast your vote in the survey on whether you agree that this kind of reporting is unwarranted click (HERE)

It’s almost like you can’t trust people these days. You’d think if someone broke into a house looking for valuables they’d at least leave the “work” stuff alone. But NO, the thieves have to go for the laptop, without any regard for how much “sensitive information” might be on it. No regard for the red tape it will put you through when it goes missing. The nerve! Why couldn’t they have just taken the kids’ iPod? It’s worth almost as much…

Folks, it’s all just becoming a bit too much for me, these breaches that could easily have been prevented. This one happened a bit closer to home for me (click HERE). Continue Reading »

Without going too extreme, I believe it is often possible to have better security with fewer policies and rules. But don’t be fooled; simplifying is rarely “easy”. It’s like the writer telling the editor, “Sorry, I had to submit a 100 page story, but I didn’t have time to make it shorter.

My case studies to date have all focussed on breaches due to inadequate security policies, safeguards or human decisions. I would like to start dealing with success stories. I have a hunch that there are at least a few Security Managers or executives who have done a good job of crafting policies and keeping their staff educated about security issues.

Continue Reading »

So, why do security professionals harp on the need for encryption so much? Because we assume encryption safeguards will be done properly, and in conjunction with other layers of security that will complement them.

In this breach (summarized HERE, and originally reported HERE), a server containing credit card numbers was compromised by hackers from the Internet. The company was a provider of news and ad syndication for the web. The breach allowed the credit card information of 4500 customers to be stolen.

Continue Reading »