January 2005 ISSN 1353-4858
Featured this month
Contents NEWS
Internet Explorer security - is there any hope? Patience with Internet Explorer is being tested to the limit. The average number of announced vulnerabilities over the last two years has averaged at nearly three per month in IE version 6. Some of these major nasty vulnerabilities include Cross domain/zone vulnerabilities, MIMEtype determination flaws, GUI control problems, scripting handling-related vulnerabilities among others. Despite this poor record, paradoxically, IE appears to have been created with some security in mind. For example, IE users can set various levels of security in various zones - Internet, local intranet, trusted sites, and restricted sites. But despite these superficial appearances, IE is extremely flawed from a security perspective warns Dr Eugene Schultz at University of California/Berkeley Lab. He presents several realistic solutions for dealing with security problems in the IE browser. Turn to page 6…
Wave of deceit crashes on charitable
1
Reuters steps up outsourced monitoring 2 Symantec buys Veritas to broaden enterprise appeal
3
Bullish British SMEs poised to splash on IT security Jail for bug finding researcher?
20 20
FEATURES Asian Tsunami Tsunami spares global IT but shakes up disaster recovery plans
4
Internet Explorer Internet Explorer security: is there any
Wave of deceit crashes on the charitable Nova Dudley-Gough For every action there must be an equal and opposite reaction - and the reaction to the generosity shown in the face of the tsunami disaster has been that of profiteering and malicious falsehood. Unsolicited emails, containing everything from hastily rehashed 419 scams to fake offers of help in finding missing loved ones have started to land in peoples' inboxes. The FBI announced the sad spate of spam in a conference in Washington on 5 January. It warned the general public to be on their guard when receiving unsolicited email such as this and to not donate any money unless they are sure of the legitimacy of the charity. Emails have ranged from requests for monetary donations, to those with links to fraudulent charitable sites which can download Trojans to the computer. Victims that have posted details of missing friends and family have also received unsolicited email offering assistance in finding them for a fee. While the FBI is actively pursuing the people behind these scams, it has not yet released any examples of the emails. In the meantime, any suspicious emails should be forwarded to IC3, the US Internet Crime Complaint Center. More information: www.ic3.gov
hope?
6
Embedded Security Embedded security and the drivers behind it
10
Network Assessment Low-level network assessment: firewalls
14
Employee Monitoring Is big boss watching you?
17
Vulnerability roundup More holes in a phishing net
18
Spyware Pervasive spyware
19
REGULARS News in brief Events
3 20
ISSN 1353-4858/05 © 2005 Elsevier Ltd. All rights reserved This journal and the individual contributions contained in it are protected under copyright by Elsevier Ltd, and the following terms and conditions apply to their use: Photocopying Single photocopies of single articles may be made for personal use as allowed by national copyright laws. Permission of the publisher and payment of a fee is required for all other photocopying, including multiple or systematic copying, copying for advertising or promotional purposes, resale, and all forms of document delivery. Special rates are available for educational institutions that wish to make photocopies for non-profit educational classroom use.
NEWS
Editorial office: Elsevier Advanced Technology PO Box 150 Kidlington, Oxford OX5 1AS, United Kingdom Tel:+44 (0)1865 843645 Fax: +44 (0)1865 853971 E-mail:
[email protected] Website: www.compseconline.com Editor: Sarah Hilley Supporting Editor: Ian Grant Senior Editor: Sarah Gordon International Editoral Advisory Board: Dario Forte, Edward Amoroso, AT&T Bell Laboratories; Fred Cohen, Fred Cohen & Associates; Jon David, The Fortress; Bill Hancock, Exodus Communications; Ken Lindup, Consultant at Cylink; Dennis Longley, Queensland University of Technology; Tim Myers, Novell; Tom Mulhall; Padget Petterson, Martin Marietta; Eugene Schultz, California University, Berkeley Lab; Eugene Spafford, Purdue University; Winn Schwartau, Inter.Pact Production/Design Controller: Esther Ibbotson Permissions may be sought directly from Elsevier Global Rights Department, PO Box 800, Oxford OX5 1DX, UK; phone: (+44) 1865 843830, fax: (+44) 1865 853333, e-mail: permissions@elsevier. com. You may also contact Global Rights directly through Elsevier’s home page (http:// www.elsevier.com), selecting first ‘Support & contact’, then ‘Copyright & permission’. In the USA, users may clear permissions and make payments through the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, USA; phone: (+1) (978) 7508400, fax: (+1) (978) 7504744, and in the UK through the Copyright Licensing Agency Rapid Clearance Service (CLARCS), 90 Tottenham Court Road, London W1P 0LP, UK; phone: (+44) (0) 20 7631 5555; fax: (+44) (0) 20 7631 5500. Other countries may have a local reprographic rights agency for payments. Derivative Works Subscribers may reproduce tables of contents or prepare lists of articles including abstracts for internal circulation within their institutions. Permission of the Publisher is required for resale or distribution outside the institution. Permission of the Publisher is required for all other derivative works, including compilations and translations. Electronic Storage or Usage Permission of the Publisher is required to store or use electronically any material contained in this journal, including any article or part of an article. Except as outlined above, no part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without prior written permission of the Publisher. Address permissions requests to: Elsevier Science Global Rights Department, at the mail, fax and e-mail addresses noted above. Notice No responsibility is assumed by the Publisher for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions or ideas contained in the material herein. Because of rapid advances in the medical sciences, in particular, independent verification of diagnoses and drug dosages should be made. Although all advertising material is expected to conform to ethical (medical) standards, inclusion in this publication does not constitute a guarantee or endorsement of the quality or value of such product or of the claims made of it by its manufacturer. 02158 Printed by Mayfield Press (Oxford) LImited
2
Network Security
Reuters steps up outsourced monitoring
Symantec buys Veritas to broaden enterprise appeal
Brian McKenna euters is outsourcing intrusion monitoring to NetSec, a Washington-based MSSP with notable US government contracts.
Brian McKenna ig Yellow' has announced a merger with storage software vendor Veritas, in a move that broadens its product range into the enterprise market.
NetSec is currently monitoring about a dozen intrusion detection devices and some associated firewalls on the global information provider’s networks, and is increasing that to a few dozen, confirmed Malcolm Kelly, global IT security director responsible for operational security at Reuters. The devices are deployed in Europe, the United States and Asia, and the MSSP is monitoring them from its Secure Operations Centre near Washington. "They are monitoring critical points on the network just now, and we will review the situation once the twelve months has elapsed”, said Kelly. “We are seeing a lot of benefits.” Reuters selected NetSec after a review of managed security service providers that included Symantec, Qinetiq, Ubizen, Verisign, and Unisys. "They had a very strong Web portal capability”, said Kelly. “They were also good from a workflow perspective, and have a good roadmap”. Explaining the business rationale for the deal, Kelly said: “We get more and more requests from our major clients about what we are doing from a security perspective; and we have networks going into the major banks. So it is good for us to match them”. "Reuters also has to be careful about any technology that automatically shuts things down — our top priority is continued service”. In a statement, Glenn Hazard, CEO of NetSec said: “Reuters requires a managed security services provider that has the same reach and 24x7 operations mentality”.
After the all-stock acquisition closes in the second quarter of 2005, Symantec expects to have annual revenue of $5bn. Only Microsoft, Oracle and SAP make more money from software. Based on Symantec’s stock price of $27.38 at market close on 15 December, 2004, the transaction is valued at approximately $13.5bn. The deal marked the second major merger of software firms in the same week, following Oracle’s $10.3bn takeover of PeopleSoft. Ajei Gopal, senior vice president for technology and corporate development, Symantec said that the merger was “an offensive move. It’s not about cutting costs, but about growth.” Asked what kind of company the new Symantec will be, he said: “We will be an information integrity company.” "Security is not a thing unto itself. We’ve found that the customer conversation was broadening from beyond that to IT infrastructure. The confluence of information availability and security is key. And so we made the natural link to join up with Veritas, as the information availability leader.” "The combined company will offer the most comprehensive solution in the market for security and availability in heterogeneous environments — from the desk top to the data centre, and from consumers through SMBs to large enterprises.” Gopal said that the company had started looking at the “confluence of security and availability” a year ago, with the Powerquest and On Technology acquisitions. The Powerquest acquisition gave it capabilities in imaging, provisioning, storage management, and disaster recovery. The On acquisition added enterprise management.
R
'B
January 2005
NEWS Gopal said that “if you peel back the skin of the products acquired through those acquisitions, and compare them at next level of detail, they compare well with Veritas technology, like NetBack up and Backup Exec. They overlap at high level, but not at a level of detail.” He said that Symantec considered the move “overwhelmingly the right one. It was a straightforward discussion. It is a friendly merger, with the management teams aligned.” The combined company will operate under the Symantec name. John W. Thompson, chairman and chief executive officer of Symantec, will continue as chairman and CEO of the combined company. Gary L. Bloom, chairman, president and chief executive officer of Veritas, will be vice-chairman and president of the combined company. The board directors of the combined company will include six members of Symantec’s current board and four from Veritas’ current board for a total of 10 members. John W. Thompson said, in a statement smacking of the language of security – the traditional ‘CIA’ of confidentiality, integrity, and availability : “The new Symantec will help customers balance the need to both secure their information and make it available, thus ensuring its integrity. We believe that information integrity provides the most cost-effective, responsive way to keep businesses up, running and growing in the face of system failures, Internet threats or natural disasters.” "Our customers have told us that one of their most critical needs is to enable 24x7 access to information. At the same time, they must maintain tight security, comply with all regulatory requirements and operate within their existing budget constraints,” said Gary L. Bloom. The revenue of the combined company is expected to be approximately $5 billion for fiscal year 2006, which begins in April 2005 and ends in March 2006. Approximately 75% of the revenue of the combined company is expected to come from the enterprise business, and 25% from the consumer business. Symantec's current ratio is about 50/50. In addition, the combined company will have approximately $5 billion in cash.
January 2005
In brief ID THEFT COSTS US $50bn AND RED FACES ID theft is growing. The US Federal Trade Commission (FTC) estimates that almost 10 million Americans were victims of identity theft last year, with a total cost to businesses and consumers of over $50 billion. And over the New Year weekend, hackers stole the personal details of more than 30,000 students, faculty and staff from a server at George Mason University in Virginia, USA. The data included names, photos, Social Security numbers and campus ID numbers. The university is home to the Information Security Institute, the Lab for Information Security Technology and the Center for Secure Information Systems, which the US National Security Agency recognises as a Center of Academic Excellence. Well, it did. HOTMAIL HOTFOOTS IT TO TREND MICRO Microsoft's MSN Hotmail has changed allegiance from McAfee Inc to Trend Micro for the antivirus scanning of its email service. The new contract means that Trend Micro will be responsible for protecting over 187 million email accounts from viruses, worms and Trojans. McAfee was previously responsible for the account from 2000. MICROSOFT ACQUIRES GIANT TO FIGHT SPYWARE In a move "long overdue," Microsoft has released two security tools to help users get rid of spyware and other malicious code. One is a free beta version of Windows AntiSpyware, which is based on technology it acquired when it bought Giant Company Software last month. The other, from Romanian antivirus software developer GeCAD Software, removes worms, viruses and other malicious code from PCs. UK FIRMS CALL FOR SECURITY PROFESSIONALISM BT, BP, and Vodafone are among the UK companies joining calls from IT security academics and professionals for new IT security qualifications and a formal accreditation body. The move follows the introduction of tough new regulations to safeguard corporate data in the wake of accounting frauds at Enron, Worldcom, Parmalat and Ahold. The 2004 Department of Trade & Industry survey into information security breaches found two-thirds of UK firms suffered malicious security breaches, with the worst incidents costing large companies an average of £120,000. SPAMMERS AIM AT BRITISH KIDS Six out of 10 emails to British students are spam, according to Email Systems, an e-mail
management specialist that filters mail for 1.1 million academic in-boxes. MD Neil Hammerton says "It's deeply concerning that young children are being exposed to these e-mails, particularly those with hardcore pornography." He added that curious children may follow links that could lead to downloading Trojans or spyware that could make "zombies" of their PCs. PHILEAS TRACKS SPYWARE ACROSS THE WEB Webroot Software of Boulder, Colorado has introduced a bot-based system that searches and destroys spyware anywhere on the Web. Called Phileas, the system can spot spyware, adware and other types of potentially unwanted software faster and more comprehensively than any other current research method, its makers claim. The bots trawl the Net continuously to identify and archive the HTML sources and URLs in the Webroot spyware definition database. First use identified more than 20,000 sites that deploy spyware through drive-by downloads, as well as several new spyware variants. PASSPORT EXPIRES Despite 200 million Passport users, Microsoft may be "repurposing" its controversial Web identity management system after eBay and several other large companies stopped Passport users from accessing their services. Last year market analyst Gartner Group reported "serious doubts about the reliability of every Passport identity issued to date." The move shifts the focus of identity management to firms like VeriSign and RSA Security, although work from an anti-Passport group, the Liberty Alliance, may come to the fore. FEDERAL IT UNDER CONTROL WHITE HOUSE Some 70% of federal IT systems are secure and 72% of 26 major departments now measure the performance of their IT investments, and about half of those agencies meet at least 90% of their cost and schedule goals, says a new White House report, Expanding EGovernment: Partnering for a ResultsOriented Government. This year the White House wants 90% of all IT systems certified and accredited as secure; 75% of agencies to have clear target benefits against costs, and less than 10% of systems to end up broken. Success will be determined by agency adoption and citizens' use of E-government systems, the report says. TIPPINGPOINT SNAPPED UP BY 3COM For the bargain price of $430million (cash), 3Com have boosted their enterprise security portfolio by purchasing TippingPoint,an intrusion prevention company.
Network Security
3
ASIAN TSUNAMI
Tsunami spares global IT but shakes up disaster recovery plans Philip Hunter Despite the Asian Tsunami’s massive toll of human life and devastation of local businesses in the region, the impact on the global economy and on major IT centres or networks has been relatively slight. Anyone listening merely to the financial news since 26 December would have been quite unaware that one of the worst natural disasters of recent times had just taken place, to judge from the soaring stock markets. Similarly news about IT has focused on its role in helping local businesses, delivering aid, or making donations, more than on disruption to computer services. Yet in some respects the disaster has served, if not quite as a wakeup call, then at least to draw attention to the merits of a good disaster recovery plan avoiding reliance on any one geographical location to house operations or data. The Indian city of Chennai, severely affected by the tsunami, was chosen as the location for a number of major outsourcing centres for IT development because in the South East of the country it is as far as possible from the zone of any border dispute between India and Pakistan in the north. The chance of such a dispute has faded recently, but was a factor considered by several outsourcing companies in deciding their location.
Beyond the reach of the tsunami Naturally clients of such firms, often major western enterprises, were concerned both about the continuity of their development work and the well being of people they knew in the city, but in the event there was little disruption. Most facilities were located some distance inland beyond the reach of the Tsunami, although in general typhoons in the Bay of Bengal causing tidal surges had actually been considered a greater threat. But beyond this many firms, such as the Indian IT services 4
Network Security
company Birlasoft which has a development centre in Chennai, replicate their data across several sites. Birlasoft did not need to invoke any recovery plans after the Tsunami struck the city because data is continually replicated across three sites, Chennai, Noida and New Jersey. No doubt the disaster will ensure that all outsourcers in the city adopt this practice, if they have not already done so.
Far from the epicentre The disaster also reminded the world that Tsunamis can devastate coastal regions thousands of miles from the epicentre of the earthquake or landslip that caused them, in this case the coast of Somalia in east Africa. Ironically
“
Chennai was chosen for a number of major outsourcing
”
centres
a study of global natural disaster hotspots by the International Research Institute for Climate Prediction identified Sri Lanka as being at risk from floods, cyclones and landslides, but dismissed the threats of earthquake and volcanic activity as negligible. To an extent this was correct, in so far as Sri Lanka is well away from the zone of tectonic plate convergence that set off the killer Tsunamis on Boxing Day, and no tremors were felt there. But the study highlighted how the Tsunami threat has often been neglected. Such neglect is unlikely to be repeated, but the threat of Tsunamis still has to be considered in the context of earthquakes and, in some locations, landslips. Some regions not prone to earthquakes, such as Sri Lanka, are clearly at risk from Tsunamis caused by distant earthquakes. There are also seismically stable regions, such as the coasts of the eastern US and Western Europe, at slight risk of a huge Tsunami triggered by the slip of part of La Palma in the Canary Islands. On the other hand there are inland earthquake zones, such as Armenia, that are not at risk from Tsunamis. There are also coastal regions at low risk because they are shielded by other landmasses from potential sources of Tsunamis. In areas that are seismically inactive but still at risk from Tsunamis, critical facilities including airports and key communications or energy centres as well as IT should be located a few Kms inland beyond the reach of Tsunamis. Even the largest Tsunamis rarely penetrate beyond 10 Kms inland, and it is not worth guarding against the very worst cases – there is ultimately no way of protecting against extreme cataclysms.
Some disasters are so rare... Indeed the recent floods in the UK area of Cumbria highlighted the issue of balancing cost against the risk of major disasters. Ironically new flood defences under construction at the time would have failed to protect the city, because
January 2005
ASIAN TSUNAMI
“
strike and where there are many major IT centres.
Tsunamis rarely penetrate beyond 10 kms
”
inland
they catered only for once in 100 year events. The floods were more severe than that, estimated to be a once in 200-year event. This is admittedly a rather arbitrary assessment of the flood’s severity, but naturally the new flood defences are being upgraded such that they would have protected the city against the recent flood. The reaction to the Asian Tsunami is similar to the extent that it is being used as a gauge to determine the degree of severity that should be protected against, ie the height above sea level or distance inland at which to locate critical facilities.
Back up data across 2/3 sites But in the case of IT operations or software development centres there are some other considerations. Vital data might be backed up across two or three sites to reduce exposure to a disaster at any single location. In such cases it is important to ensure that the sites are not all exposed to the same disaster. Earthquake prone locations are best avoided, but clearly this is not always possible – after all Silicon Valley is close to the San Andreas Fault. But then it is all the more important to ensure that other sites serving as backup should not be at risk from the same disaster. In the case of Tsunamis as we have seen, places several thousand miles apart can be destroyed as a result of the same geological event. This needs to be considered in parts of the world such as California, Japan, and the east coast of North America where Tsunamis could
January 2005
People There are also human resources to consider. Some organisations have failed to take risk into account when outsourcing call centres or software development to parts of the world where the saving in labour costs may be partly offset by greater political instability or risk of natural disaster. It may be worth distributing human expertise as well as data and perhaps computer hardware across two or more sites. On the other hand excessive paranoia should be discouraged. It has been known for some large enterprises to prohibit more than two of their senior executives from travelling on the same flight, but given that the low probability of their plane crashing this form of risk mitigation may not be worth the inconvenience. An important principle of risk management lies in balancing the probabilities
“
Land-based communications can be backed up by microwave
”
radio links
of particular disasters against both the severity of the consequences should they occur and the cost of protecting against them. There may be both a direct financial cost, and indirect impact on efficiency.
Power and communications
itself but then suffering through loss of communications or electricity, although obviously such concerns were dwarfed by the immediate human tragedy. But they illustrate the need to consider how to back these up so that a given IT centre can continue operating normally without interruption in the event perhaps of a modest disaster. For example land-based communications more prone to earthquakes can be backed up by microwave radio links. Power can be backed up by emergency generators.
Recovery plan Then there is the question of the recovery plan, which needs to be regularly revised and tested to ensure that it really does provide continuity in the face of the current configuration and data traffic load. Some disasters, including earthquakes and plane crashes onto a building, in effect strike out of the blue without warning and so the plan has to allow for continuous backup of data with real time restoral at a remote site to avoid significant loss or disruption. But there may some warning of other disasters, including hurricanes, floods resulting from storm surges on coasts or high rainfall, and potentially Tsunamis. In these cases there can be a few hours to take firmer action to maintain continuity, including evacuation of staff and perhaps some of the hardware – computers are smaller these days. The bottom line is that recover plans need to go beyond mere shadowing of data across multiple sites. The human resources dimension should be taken into account, as should the nature of the potential disasters and the level of threat they pose to each location. Risk management strategies need to consider major natural disasters in a similar context to other threats such as those posed by hackers or disgruntled employees.
Communications and power supply also need to be factored into the equation. There were instances of businesses being untouched by the Asian Tsunami
Network Security
5
INTERNET EXPLORER
Internet Explorer security: is there any hope? Dr E. Eugene Schultz, University of California/Berkeley Lab Microsoft's internet browser, Internet Explorer, may be the most popular browser on the market, but its vulnerability to attack, and Microsoft's seeming inability to make it secure, is making people switch. The Worldwide Web (WWW) has transformed the internet, dramatically increasing its appeal and usefulness to individuals and organizations. At first the Web had few security problems, but vulnerabilities in Web servers, particularly in Microsoft's Internet Information Server (IIS), have been exposed. The default level of security in Web servers such as Apache and IIS has improved considerably, and the rate at which new vulnerabilities in these and other Web servers have been identified also appears to have slowed down considerably over the last few years. Yet the Web is still very much a dangerous place. This is now due to a large degree on a myriad of vulnerabilities in Web browsers, particularly in Microsoft's Internet Explorer (IE). The average number of announced vulnerabilities in IE per month is virtually unparalleled, nearly three per month in IE6 over the last two years, according to Secunia (SECU04). Most troubling is that of the announced IE vulnerabilities, 14% have been rated as extremely critical and 34% have been rated highly critical. Although IE is currently the most widely used Web browser, there has been a regular stream of bulletins from Microsoft and others that describe yet more IE security vulnerabilities and media accounts of real-life incidents in which IE vulnerabilities have been exploited (EVER04). These reports have hurt IE's popularity considerably. Attacks on systems that exploit IE vulnerabilities are commonplace and 6
Network Security
E. Eugene Schultz
degree. This browser offers a wide range of features designed to control users' levels of security and privacy. IE users can, for example, set desired levels of security in various zones Internet, local intranet, trusted sites, and restricted sites (see Figure 1). This helps (at least in theory) to restrict the way code from unknown websites executes on the machine on which this browser runs. IE is, for example, designed to keep JavaScript from websites within the Internet zone from running in the context of the local machine. The permissions of files running from the local hard drive are also considerably less restrictive than the permissions of code that has been downloaded from an untrusted zone. IE, for instance, tries to keep executables downloaded from sites within the Internet zone from accessing data within the local machine. IE also displays prompts before potentially unsafe content can be downloaded; by default it prevents unsigned ActiveX controls from being downloaded. Furthermore, IE has many advanced settings that control functions such as checking whether certificates have been revoked, verifying signatures for executables, and enabling Secure Sockets Layer
growing rapidly. Certain vulnerabilities allow spammers to pop up Windows on users' computers. This includes Spyware such as the hard-to-kill DSO Exploit, which exploits security settings for the My Computer zone to allow downloading of unsigned ActiveX controls. DSO Exploit makes it easy for outsiders to pop up windows on remote users' displays at will and then present content ranging from advertisements to pornographic material. Other vulnerabilities, some of which will be discussed shortly, allow attackers to gain complete control of systems that run IE. Although IE vulnerabilities are by no means exclusive to IE running on Windows operating systems, the vast majority of IE vulnerabilities are in Windows-based versions of IE. Concerned by the number of serious vulnerabilities in IE, the CERT/CC has recommended against using IE altogether (REGI04). Some organizations have followed suit by banning the use of IE by their employees. Paradoxically, IE appears to have been created with Figure 1 - IE Web Security Zone Options security in mind, at least to some
January 2005
INTERNET EXPLORER (SSL) and other types of encryption (see Figure 2).
Major IE vulnerabilities Despite superficial appearances, IE (Note 1) is extremely flawed from a security perspective. This is shown in part by the sheer number of vulnerabilities in IE that have been identified to date. Many of these vulnerabilities can lead to particularly undesirable consequences. Several of these are discussed next.
Cross domain/zone vulnerabilities IE deploys a cross-domain security model that differentiates between browser frames from different sources. This is designed to prevent code in one domain from accessing data in a different domain. The Internet Security Manager Object (ISMO) determines the particular zone and/or domain to which a URL belongs and the actions permitted in that zone. According to this model, domains can be in different IE zones; Local Machine Zone (LMZ) is the most trusted (and privileged) zone. Cross-domain vulnerabilities permit code from one domain or zone to run in
the security context of a different one. Some of the security-related problems in IE's implementation of its cross-domain security model include: • Failure to validate the source of redirected frames, which allows malicious code to redirect frames in trusted zones to frames that are outside these zones. This causes the latter to be dealt with as if they were within trusted zones. • Ability of unauthorized individuals to determine the domain or zone of frames. • Ability to execute scripts in unusual contexts; scripts can be even embedded and then run in objects such as cookies. Cross domain into LMZ means any attacker can take any action that the user on the machine with a vulnerable IE browser can take. The worst case is when a user has logged on with Administrator privileges, because an attacker who exploits cross domain or zone vulnerabilities has the same level of privileges as the user. This gives complete control of the system to an unauthorized person. Worse, code to exploit cross domain and zone vulnerabilities is widely available on the internet.
MIME-type determination flaws
Figure 2 - IE Advanced Security Options
January 2005
MIME stands for Multipurpose Internet Mail Extensions. MIMEtype determination describes how a file is handled. Options include viewing an image or using MHTML (Note 2) or Multipart HTML to parse HTML, initiate a download, or run an external program.
IE normally reads up to 256 bytes into a file and then tries to match the file content against a list of defined file types. If the match is unsuccessful, a server-provided content-type header or file extension may be used instead. If the content-type header or file extension also fails, examination of file content and/or the name extension may also be used. HTTP (Hypertext Transfer Protocol) is a request-response protocol. When a client sends a request to a server, the request specifies the request method, URI (Uniform Resource Identifier, aka URL), and protocol version. It also contains a MIME-like message with request modifiers, client information, and possible body content. The server responds with a status line that includes the message's protocol version and a success or error code, which is followed by a MIME-like message with server information, high-level entity information, and potential entity body content. If and only if the media type is not indicated by a Content Type field, the recipient may try to guess the media type by inspecting its content and/or the name extension. MIME type determination vulnerabilities are exploited when a user connects to a Web page such as http://www.somesite.com/image.jpg and image.jpg is not an image, but is instead HTML (Hypertext Markup Language) that contains a malicious executable. The IE browser reads the file, recognizes that it is HTML, parses it with MHTML, and then runs the executable. This could potentially allow a perpetrator to take any action on a user's system.
GUI (Graphical User Interface) control problems IE allows events created using a mouse to call methods that manipulate window objects (e.g. as in drag and drop operations). A bug in IE allows an attacker to use method caching to gain control over the manipulation of window objects via many functions, one of which is window.moveBy.
Network Security
7
INTERNET EXPLORER In another GUI control bug, an attacker can use mouse-initiated events to invoke a script function that calls methods to gain access to the user's Favourites directory by referencing an ActiveX object named ShellNameSpace.
elements was identified recently. A buffer overflow condition or denial of service (specifically, an IE crash) can happen when IE processes a malicious HTML document with excessively long strings in the SRC and NAME attributes of the previously mentioned elements.
Scripting handling-related vulnerabilities Several types of serious scripting-related vulnerabilities have also been discovered. One such vulnerability concerns how ActiveX controls are labelled and handled. Only a control that is labelled safe for scripting should be able to be called from IE, but safe for scripting constraints are not always enforced correctly. Two ActiveX controls, Eyedog (a control used in connection with Windows diagnostic software) and scriptlet.typelib (a control that enables developers to create Type libraries for Windows scripting components) are both labelled safe for scripting, and can therefore be called from IE. But Eyedog can allow unprivileged users or programs to glean information about the Registry and characteristics of the system in which it runs. It is also vulnerable to a buffer overflow condition that can result in execution of rogue code. scriptlet.typelib allows unprivileged users or programs to create and change files in the system on which IE runs. In addition, the Microsoft virtual machine (Microsoft VM) has a security exposure that may allow script code in a Web page or HTML email message to reach and execute ActiveX controls. This is despite that fact that these controls should not be available under these conditions. A perpetrator could set up a malicious Web page in this manner to exploit this bug, thereby potentially gaining full control of a system on which IE is used to visit the malicious page.
HTML elements buffer overflow vulnerability A highly critical vulnerability in the way IE handles some attributes in the <IFRAME> and HTML 8
Network Security
“
Vulnerability reports have hit IE’s
”
popularity
This vulnerability can be exploited when a user with a vulnerable IE browser clicks on a link to a Web site contained within the body of an email message, directing the browser to a Web page that contains the malicious HTML. A variant of the MyDoom worm is already exploiting this vulnerability, which is described in Microsoft Security Bulletin MS04-040 (MICR04a).
Other recent vulnerabilities The Microsoft bulletin MS04-038 (MIC04b) describes a number of recent IE vulnerabilities, which, like the previously mentioned Microsoft Security Bulletin MS04-040), announces the availability of cumulative patches for IE. Some of the worst of these vulnerabilities include: • A CSS (Note 3) heap memory corruption vulnerability. A perpetrator could create a malicious Web page that, if visited by a user, could result in the execution of rogue code that allows the code to execute with the same privilege level as the user. The worse case scenario would be exploiting this vulnerability while the user is logged on with Administrator privileges. • A cross-domain vulnerability in similar method name redirection. This refers to the fact that IE deals with
navigation methods by using functions that have similar names. A user could visit a malicious Web page containing rogue code that could execute in the LMZ; this could give the code the privileges of the user on the system on which IE runs. • The install engine vulnerability, which involves a buffer overflow condition in a dynamic link library, inseng.dll, allows execution of rogue code on the system that runs IE. A user has to click on a link that redirects a connection to a malicious Web page. The code runs with the level of privileges of the user; if the user has Administrator-level privileges, the code would run with the same level of privileges. • The navigation address bar spoofing vulnerability, which exploits flaws in the way IE deals with plug-in-related navigation. This could result in the system displaying a bogus URL in IE's address bar while the content of an entirely different website is shown on screen. If the different website is malicious, a user might unknowingly supply sensitive information (such as personal financial information) to this site, thereby risking identity theft and other undesirable outcomes.
Solutions As stated above, the major security problems in IE are found in Windows-based versions of this browser. Few IE vulnerabilities have, for example, surfaced in versions of IE that run on Macintosh systems. Running IE on a Macintosh is thus a potential solution, although one might reasonably question the wisdom of a decision to change operating systems throughout an enterprise simply to obtain a safer version of a Web browser. Fortunately, several more realistic solutions for dealing with security problems in the IE browser are available. These solutions include: avoiding IE altogether; continuing to use IE, but making IE more secure through various measures such as configuration changes and installing Service Packs
January 2005
INTERNET EXPLORER and hot fixes; and using IE only when necessary.
IE - just say no The first possible solution is, as CERT/CC has recommended, to "just say no" to this browser. There are two major variations of this solution: to actually uninstall IE, and to not use it. The first option is extremely undesirable because IE is so closely integrated into Windows operating systems, which depend on IE for much of their functionality. For example, if IE is uninstalled, Windows Explorer, the default shell in Windows systems, will no longer work. The second option, to avoid using IE, is thus better. There are several considerably less vulnerability-riddled Web browsers with excellent functionality. These include Opera, Mozilla, Safari, and Netscape. Those browsers that are not free are priced very reasonably. The major downside to avoiding using IE altogether is that certain websites and applications work only in conjunction with IE. This leaves users little choice. Still, many users have found that browsers such as Mozilla, especially the most recent versions, work perfectly with a very large majority of websites.
Using IE Of course, another solution is to continue to use IE, but to make it as secure as possible. This requires disabling many capabilities and features such as active scripting and ActiveX controls. This is particularly true in any zone (e.g. the Internet and Restricted Sites Zone) in which untrusted HTML content is rendered. Disabling URL handlers, content handlers, and more as other features is also a must if IE is to run more securely. Promptly installing the IE-specific service packs (SPs) and hotfixes is also critical. Microsoft has in fact touted SP2 for Windows XP as a particularly good solution for IE vulnerabilities. It does not, says Microsoft, simply fix flaws in IE routines but changes the actual functionality of IE. For example this SP turns off cross-frame scripting features, extends
January 2005
the ActiveX security model, prevents the creation of pop-ups, and tightens the security of the LMZ, as well as many other things. SP2 also denies access to local files when the browser is connected to Web sites and causes users to be notified whenever .EXE files are about to be downloaded and executed.
“
Microsoft has touted SP2 for XP as a solution to IE
”
vulns.
SP2 for Windows XP is no panacea, however. For one thing, it does not fix all known IE vulnerabilities. Also, after SP2 is installed, IE will no longer work in conjunction with some websites. Flaws in this SP could allow virus writers to circumvent certain security features to cause rogue code to execute. Furthermore, SP2 for Windows XP is specific to the Windows XP operating system - it thus does not fix IE vulnerabilities in other Windows operating systems such as Windows NT and Windows 2000. Perhaps most concerting, however, is the recent report that there are at least 10 critical flaws in SP2 for Windows XP (EDWA04). Some of the worst reported include: • Attackers can gain remote access to local files on a system that runs IE, despite Windows XP's restrictions against local file access during Internet browsing. • Attackers are able to switch between security zones to gain LMZ rights, thereby elevating the privileges of executable content downloaded from the Internet. With elevated privileges, the remote code can be remotely read, write to or modify and run local files on the machine that runs IE.
• Attackers can circumvent this SP's notification mechanism when .EXE files are downloaded and executed. This allows potentially malicious software to be downloaded without any warning to the user.
Use IE only when necessary A final solution considered here is to use IE only when absolutely necessary, i.e. when a website will interact with no browser but IE, but otherwise to use another browser such as Opera or Mozilla. This minimizes the security risks associated with IE but does not deprive users of IE when no other browser will work. If this solution is chosen, IE should be turned off (e.g., by going from File -> Close) whenever it is not in use. This minimizes the probability that some of the many vulnerabilities in IE will be exploited. Anyone who uses IE should also logon with user-level, not Administrator-level privileges. Additionally, it is imperative to keep up with all IE Service Packs and hot fixes. The major limitation to this solution is the difficulty of obtaining the co-operation from users, most of whom would rather use a single browser all the time rather than have to switch at odd times.
Conclusion The sheer number of vulnerabilities in IE is a major cause for concern. The fact that other programs, such as Outlook and Outlook Express, may also be affected by vulnerabilities such as security flaws in IE ActiveX controls adds considerably to the level of concern. The fact that there are so many dependencies between Windows operating systems and IE makes the situation worse. Indeed, it is hard to understand why an operating system vendor would integrate Web browser functionality with operating system functionality, given all the security risks associated with the Web. The failure of SP2 to provide the strong remedy that Microsoft promised just adds fuel to the fire.
Network Security
9
EMBEDDED SECURITY All things considered, therefore, IE is just too risky for unrestricted use in security-conscious organizations. If IE is to be used, it must be used on a very limited basis, and only if it is configured properly and updated frequently with patches.
Next? What is in store for IE's future? The future of IE does not now look very bright. As stated above, IE's popularity is declining rapidly because of the constant onslaught against it. If IE's reputation and market share is to recover, Microsoft will have to do with this browser what it did with the IIS Web server. Versions 1 through 5 of IIS were riddled with security-related vulnerabilities, but then Microsoft launched its Trusted Computing Initiative. Among other things this rescribed the use of widely accepted security engineering methods during software development. Microsoft rewrote the IIS code in accordance with TCI-prescribed methods; to date, no security vulnerability in IIS 6 has surfaced. Unfortunately for Microsoft, the changes came a bit too late. Use of IIS has shrunk drastically and has not recovered despite the fact that IIS 6 is
“
EVER04 Everett, Cath, Testing times for beleaguered Internet Explorer. Network Security, July 2004, 1 - 2.
IE is just too risky for unrestricted
”
use
now so much better from a security perspective. Will Microsoft take the same approach with IE that it has taken with IIS? Probably, but the real question is whether Microsoft is once again too late.
About the author E. Eugene Schultz, PhD, CISSP, CISM, works at the University of California/Berkeley Lab
References EDWA04 Edwards, Mark Joseph, Update: Ten New Security Holes in Windows XP SP2? Web posting, 2004. http://www.winntmag.com/Windows/Article/ArticleID/445 02/Windows_44502.html
Embedded security and the drivers behind it Ionut Ionescu Technological, economic, social and political drivers Ionut Ionescu will foster demand for embedded security. Have you ever listened to a motivational motivation into the organization, the speaker? I tend to be quite sceptical of coach's speech usually centres on people such presentations, unless of course, one who have overcome great adversity in of the examples they give relates to one their lives to achieve great goals, like of my heroes. Nelson Mandela, Sylvester Stallone, etc. Whenever management wants to But have you heard them tell the energise the troops and breathe new story about the poor IT security 10
Network Security
MICR04a Microsoft Corporation, Cumulative Security Update for Internet Explorer, 2004. http://www.microsoft. com/technet/security/bulletin/MS04040.mspx MICR04b Microsoft Corporation, Cumulative Security Update for Internet Explorer, 2004. http://www.microsoft. com/technet/security/bulletin/MS04040.mspx REGI04 The Register. CERT recommends anything but IE. Web posting, 2004. http://www.theregister.co.uk/ 2004/06/28/cert_ditch_explorer/ SECU04 Microsoft Internet Explorer Advisories. Web posting, 2004. http://secunia.com/graph/?type=adv8prod=118period=all
Notes Note 1 - This paper covers IE 5, 5.5 and 6, although the major focus is on IE6. Note 2 - MHTML defines how objects that are normally referred to by URLs are named and aggregated. Note 3 - CSS stands for Cascading Style Sheets (CSS), a feature that facilitates creating and managing Web content.
manager who couldn't make sense of his company's IT jungle or how to secure it, and how it took him or her years of hard work, but he/she got there in the end? Well, probably not, because security, like health and safety, is only noticed when it doesn't work and some horrible event happens. When it all works, nobody notices, and that's how it should be.
Why is it not working today? I think we all know the answer to this question: security is hard to implement, maintain and measure because in most cases it is retrofitted rather than built into a system, network or business
January 2005
EMBEDDED SECURITY process. This is generally not true for military systems, which have a unique operational paradigm compared to systems for everyday business use. But another reason could be the relative immaturity of the commercial IT security market. It was only five years ago that security software vendors began to use humour and sexual imagery in their advertising. These were sure signs that the industry was going mainstream. As the market reach for security products and services grew to include all users from government institutions to the home user, the message had to change. End users seldom care much about the strength of the encryption key your product uses or obscure techie acronyms like IKE and FIPS. Getting your message across meant articulating the user benefits in clear, jargon-free language and having a keen price. But that's not enough, and never was.
Drivers for change Many factors drive change, but we can group them into four categories: economic, political, technological and social. All these require a new approach to securing information systems, which I call "embedded security." Embedded security means building security in from the start. Into all hardware, software, ICT (information and communications technology) operations and business processes. In the first two, hardware and software, the vendors play the main role. In the second two, operations and business processes, the end users and the providers have to take the lead. This is already starting to happen, but, depending where you sit in the organization, it may be difficult to see. The IT professional who spends his or her time patching systems and configuring new and improved security appliances may be just as much in the dark as the
January 2005
business leader who only hears that security is still not fixed and that they need more money.
Technological factors The main drivers here are firstly the evaporation of the security perimeter, and secondly, the relatively low maintenance to effectiveness ratio of existing point security appliances and software. The problem with using a perimeter security model is that it doesn't scale. Security that works at a local level is not sufficient at a global level, even though local security policies, procedures and practices are in force and enforced. As globalisation marches on and outsourcing and joint venture associations become more common, organizations need to communicate electronically with many more outside parties. These include teleworkers, partners, suppliers, customers, and government regulators. The shifting boundaries of the business relationship make it increasingly difficult to know who is on the inside and who is on the outside of the trust perimeter. From a security point of view, the military is lucky to have total management control over its systems, a strictly hierarchical approach to decision-making and very clear mechanisms for enforcing compliance. There, the perimeter still survives because it works. It is an integral part of the old defence in depth principle because, by definition, anyone not with me is against me, and security policy and practice reflect this. In the business world, mergers and acquisitions, the knowledge economy, the matrix management philosophy and other factors have all contributed to the creation of a multi faceted and hybrid ICT environment with mutant and permissive boundaries between departments, Web-enabled applications and users with a more diverse set of computing needs. These make it very difficult to define a perimeter and to enforce the company security policy around it.
For many organizations the solution has been to define several sub-perimeters and then to enforce Chinese Walls separation between them. This containerisation approach has worked up to a point. But, given the complexity of many current applications and the flu-
“
The perimeter still survives in the military because it
”
works
idity of the typical corporate environment, it has been only somewhat effective. A more fine-grained control of security parameters and better integration of security monitoring with enterprise management systems is required. The other problem with the current security technologies is how complicated they are. The last thing any system administrator needs is to battle for days to integrate the latest firewall with a user's PC or to read thousands of lines of log files. To be fair, most security products today are not that bad at installation. However, it is well-known that many of them either become dusty shelfware or are largely ignored in operation because of how difficult they are to configure, maintain and extract useful information from. Managing complexity is already tough enough when it comes to normal information processing. Another layer of complexity due to security can raise resentment and sometimes defiance in the average IT user.
New concepts need new responses New concepts and technologies like utility computing, grid computing,
Network Security
11
EMBEDDED SECURITY power over Ethernet, power line connectivity and others will require new ways of thinking in terms of design, deployment and operation of ICT infrastructures. At the least, they will require standards for defining, accessing and managing computing resources. Interoperability models need to be quite stringent to stop vendors from deviating from key standards by making "enhancements" to them.
Pay to play As more and more computing resources (and I use the term here for computers, networking equipment and applications) seek to access corporate information and processes from virtually anywhere, a hierarchy is necessary to prioritise accesses. Even though wider access should save costs and/or enable new sources of revenue, there are associated costs, and there should be a way for people to pay for using them. This is not possible without standards to define billing and security models and mechanisms to govern these connected infrastructures. We will need to evolve from existing models of trust based on the object/subject definition. Trust will become a rather fuzzy concept on the grid, but also central to its operation and survival.
Economic factors Whatever technological innovation is just around the corner, the truth is that society will have to continue to function and that therefore basic economic needs have to be considered. One is the need to create value and to make money from ideas and new ways of doing business. At one end of the spectrum, entrepreneurship will flourish due to better access to ideas, technology, and a globally distributed workforce and production network. At the other, every organization will still have to improve its efficiency and to protect itself against unnecessary costs and risks. Historically, organizations have preferred to delay investing in security unless they were forced to, either because 12
Network Security
Figure 1: Relative size of security investment
of mutual business interests or because the law said they must. Up until now, the popular approach has been to hide one's head in the sand and pretend or hope to avoid the need for it. But that seems to have changed with the rise of the denial-of-service attacks (DoS). In its current incarnation (the distributed DoS), it has plagued both individuals on their home computers or personal websites and larger institutions alike. DoS attacks were initially used to show off or score points among both established and aspiring hackers. It soon became a weapon of choice for organized crime. Threats and ransom demands backed up by attacks are made remotely and anonymously. This makes the job of law enforcement harder and deepens the misery of the victims who face an elusive enemy potentially deadly to their operations. As with everything in ICT, there are solutions ranging from the cheap and simple to the complicated and expensive. To really clean a pipe and separate good traffic from bad, classic provider techniques like black-holing are no longer enough. Specialised equipment is more expensive but offers the skilled user a much more selective and efficient tool in fighting DoS attacks. When a large portion of an organization's income depends on an efficient, available and reasonably
secure ICT infrastructure, the cost-benefit ratio of such DoS cleaning solutions becomes very attractive. Cable & Wireless is one of the major network providers that offers such advanced solutions for in the core security to its customers. However, no matter how advanced a product or technology is today, both technology and markets continue to evolve. Thus products and services have a limited lifespan as a moneymaker before the market responds and they become more of a commodity. This puts downward pressures on vendors' price and margins. Even so, ICT users (clients) will continue to try to avoid investment in and liability for security, preferring instead that the supplier or the provider takes it on (see figure 1). A clients' ability to insist on this depends largely on the balance of power in the marketplace. The rate of technological development in the ICT sector means that any vendor power is usually soon neutralised by its competitors. All too soon clients are able to ask for and get a reduced, commoditylevel purchase price, or that the product or service is included as standard in the provider's total offering. This healthy contention between the client and the supplier over investment in technology is another powerful driver for embedding security in tomorrow's products, services and infrastructures.
January 2005
EMBEDDED SECURITY
Political factors At present, even the most technologically advanced countries still do not use modern ICT on a large scale to interact with their citizens. Electronic voting is not yet widespread, possibly because of concerns for potential fraud. Elsewhere some countries have taken tentative steps, for example by letting their citizens submit tax returns online and perform other minor tasks. For mass adoption to happen and to have a real electronically mediated citizen-to-government (and vice versa) interaction, there are many security concerns that must be addressed. All governments are subject to similar economic pressures. They are also the ultimate guardian of trust, which means they must meet the public expectations of reliability, accuracy, honesty, and fairness. As a result, in the future political factors will become more and more powerful drivers for embedded security.
Social factors People are coming to expect cheap universal Internet access. They want it available anywhere, any time, and they don't want to worry about how everything works or how secure it is. That means big problems for service providers. The convergence of business and pleasure activities on many mediums today (e.g. mobile communications, Internet and TV banking and gaming, home teleworking), makes it hard for suppliers and providers to discover new revenue streams and billing mechanisms, as well as to prevent fraud and reduce operational and commercial risk for both themselves and their law-abiding clients. Installing and configuring a personal firewall on a home PC or turning on encryption on a SoHo wireless hub are not simple tasks for the average user. And scared consumers won't go online. Unless security is made simple (or at least simpler) many business opportunities will be lost because of
January 2005
“
Most countries still do not use modern ICT to interact with
”
their citizens
lack of consumer confidence and privacy concerns. To make security simpler, we have to design it in at the start and make sure it stays embedded in all parts of an infrastructure. The general public is thus another driver for security to evolve in this way.
The new paradigm I hope you will not be disappointed, but I have to tell you that embedding security is not rocket science. Security professionals have known for a long time that it is cheaper, easier and better to start with security in mind than to retrofit it to any computer, application or process. As any doctor would say, prevention is much better than cure. Three years ago I tried to convince clients that security is not a return on investment (ROI) issue. Instead, I suggested that organizations look at security as a cost of doing business. I also predicted that it would become a board level issue, much as health and safety is. We are now at the point where legal and regulatory requirements (e.g. Sarbanes-Oxley, Basel II, Data Protection Act, etc) have forced the issue on the board. To comply with the quickly approaching deadlines (indeed, some are already past), organizations are scrambling to install more security products and to bolt on more security provisions to existing processes and infrastructures.
Soon this will not be enough. They will have to start designing systems that are inherently more secure and to demand better but easier to use security products and services from their suppliers. Information security is going from being a nice to have add-on to being a necessary evil, and will soon be a real business enabler. As complexity grows and the granularity of the Internet increases, we shall have to improve our grasp of aspects like space and time locality to achieve better security. Security will be a core and innate attribute of any data, in storage, processing, distribution or interpretation in digital infrastructures. Already, firewalls and anti-virus technologies are moving into the routing fabric and security provisions are being included in the latest versions of the most popular operating systems. To avoid the current unsatisfactory rates of false positives produced by many current security technologies, threat detection, analysis and response will need to move very close to where data interactions happen. An area with great potential and dynamism is security management. This should become truly integrated into the new breed of enterprise and service level management systems, and enable customers and suppliers to see their actual risks more clearly and manage them more closely. Abstract data attributes or perhaps even formal languages will appear that will put security at the core of the protocols and products on the market. This is something that is really missing today, if we think only of ASN.1 and of the design of TCP/IP as examples. Not withstanding the next big thing or killer application, I believe embedded security will become a reality in the next five to 10 years. It will take time for new standards to emerge and for suppliers and providers to build products and services based on them. But the alternative to embedded security looks much worse.
About the author Ionut Ionescu is Director of Security Services at Cable & Wireless.
Network Security
13
NETWORK ASSESSMENT
Low-level network assessment: firewalls David Morgan, senior security consultant, NGS Software A common question in the computer security media these days is how to perform a more advanced network assessment, particularly with regards to firewall assessments. Most people who ask are familiar with the running of automated assessment tools, be it one of the many vulnerability scanners, the often cited Nmap (see www.insecure.org) or similar enumeration tools. These same people are aware that although these tools will run certain checks against firewalls, running only these tools will not even approach a full security review of the firewall. This article helps to fill some common gaps in knowledge, aids the secure deployment of firewalls and leads to more effective network assessments. It is not a comprehensive discussion of such techniques, but is a collection of bitesized chunks you can integrate into your existing methodology.
• A secure enforcement of the policy, i.e. the rules in the policy are actually enforced by the firewall device in the expected manner. • A secure way to manage the firewall, be it policy updates or log/alert maintenance. • The firewall device itself needs to be secure i.e. not suffer from any vulnerabilities as an isolated device.
Firewalls
Assessing firewalls
A firewall, in common parlance, is a device that controls network traffic with the goal of improving the security posture of the environment it is protecting. Firewalls are connected directly to a network. Often this makes it possible to communicate directly with them as well as through them in an appropriately secure way. To assess the effectiveness of a firewall means you must be familiar with all aspects of their role. Basically, a firewall’s role is to protect the environment behind it. To do that successfully certain key elements must be in place:
The single most effective weapon in assessing a firewall is a policybased review of the rule base. If you follow only one of the following recommendations, it should be the policy review. The technical testing process detailed later in the article, while accurate, is very time-consuming if it is not targeted at specific areas of concern. If you multiply all possible source addresses by all possible destinations and then by each protocol port, you very quickly have an impractically large number of test probes. Ideally the policy review will involve in-depth knowledge of the environments design. Failing that, it will test access to the relevant technical resources. Information that would prove beneficial includes:
• A suitable firewall policy that defines the traffic allowed to traverse the device for the successful operation of the environment as a whole. 14
Network Security
A security assessment consultant or anyone tasked with assessing the deployment of a firewall will focus their review on the appropriate application of the above four principles. The next section details this review process in more detail.
• The nature of the components that comprise the environment, i.e. which operating systems are deployed and which services are functioning on these systems? • What is the purpose of the environment, i.e. the business functions the environment performs and any relevant caveats this may impose. • How the firewall is managed, i.e. is administration access local or remote, how are updates applied and how are the system events/logging functions managed? There are many guides on best practice firewall design. Even so, we find the following points are consistently not given enough priority during security assessments: • Excessive protocols allowed through the firewall. The most common example of this is the Internet Control Message Protocol (ICMP) requests and replies. Even when the Echo Request and Reply have been disabled, it is all too common to find the address or timestamp allowed through.
“
A policy-based review is the most effective
”
weapon
• Lack of granularity in the rule base. Network-wide rules to allow access to a range of systems are extremely common. In worst case scenarios this may result in the installation of a Trojan; in any event, this will facilitate effective network mapping by outsiders. • Insecure management mechanisms. Ideally firewall management,
January 2005
NETWORK ASSESSMENT specifically configuration modifications, should be restricted to users logged on locally to the firewall. If changes are needed, they should be provided through a dedicated network to prevent administration traffic traversing a non-trusted network. In a classic remote pen-test you are unlikely to get these answers up front. The client is more interested in the “hackers view” and you may be forced to adopt a purely technical approach to the assessment. However, the end goal remains unchanged.
Practically assessing firewalls It is always a good idea to backup a policy-based review with technical confirmation. In many cases this may be the only course of action available to you. Before we discuss the techniques, it is useful to review a couple of provisos of technical testing that could save time and heartache later on: • Never test a client’s firewall through one of your own without a total appreciation of how your own firewall may influence the results you obtain. It is not always possible to avoid this, but then you need to be certain of how your firewall may influence the results. • The findings only represent what you, on your specific IP address, are able to do, if the firewall in question implements source-based access control). • Spoofing source addresses can be beneficial. However, the ability to receive the response accurately and without negatively impacting the real source are key concerns. Some firewalls implement MAC address verification, which will limit your ability to spoof if you are on a network locally connected to the firewall. It is apparent that many restrict their activities on a “firewall assessment” solely to running Nmap and obtaining a list of open, closed and filtered ports upon a
January 2005
system or a range of systems. Something similar to: Starting nmap V. 3.xx ( www.insecure.org/nmap/ ) Interesting ports on x.x.com (x.x.x.x): (The 1022 ports scanned but not shown below are in state: filtered) Port State Service 22/tcp closed ssh 80/tcp open www Nmap run completed — 1 IP address (1 host up) scanned in 2 seconds
The running of Nmap or a similar tool is an essential first step to analysing the firewall, but it does not tell the whole story. Taking the above example, we believe from the output that SSH is allowed to the target host. However, there is no such service running on this particular system. This gives us some findings and some areas to look at in more detail: • In itself, Nmap finding a closed port is often considered a vulnerability in secure environments because it is an entry port to the environment that is not required. The potential exists for someone to compromise the HTTP server in this instance and install a Trojan or a program such as Netcat on a “closed” port. The firewall would not prevent a malicious user communicating with the Trojan. • Closed ports may be a symptom of a network-wide rule. If your port scan has not already confirmed this, it may be worth scanning the entire range (staying within the remit of the assessment). This will test if the same firewall protects multiple environments with the same generic rule base, which allows a single point system compromise, or it may reveal further in-scope systems. • Or perhaps the service crashed on test. If nothing else the client should
be pleased that you highlighted its instability and should welcome your suggestions for a more robust environment. For example, we know a device is filtering but not how or where, and we have to ascertain this. We believe SSH is potentially allowed to the host
“
Back up a policy-based review with technical
”
confirmation
and maybe a device upstream of the host is sending a reset and not just dropping the request. Alternatively if the reset is proved to come from the target itself it will be a configuration error. This has to be proved one way or the other. Everyone is familiar with the concept of traceroute. Simply put, this means sending multiple packets to a target with incremental time-to-live (TTL) values to identify the path through the network to the target. However we are also very aware of its limitations: traceroute to X.X.X.X, 30 hops max, 38 byte packets 9 A.A.A.A 18.984 ms 18.547 ms 23.278 ms 10 B.B.B.B 17.157 ms 20.257 ms 25.015 ms 11 * * * 12 * * *
The typical external-facing environment will filter both ICMP and UDP packets, the cornerstones of traceroute, upon both the Windows and Unix platforms, and therefore we tend not to find
Network Security
15
NETWORK ASSESSMENT the actual target residing beyond the firewall. If we can traceroute to the target via either a UDP or ICMP traceroute, that should be a security concern in most environments. As the assessors of a firewall we have up to three key advantages thanks to our Nmap scan assuming we have a tool that can traceroute on any arbitrary TCP port: • We know the open ports that in theory should go all the way to the target. • We know the closed ports that in theory should go all the way to the target. • We know the filtered ports that for some reason (probably firewalling) are not making it all the way to the target. Fortunately mechanisms for performing TCP traceroutes to a target do indeed exist; two examples are hping (see www.hpring.org) and etrace (see http://www.wastelands. gen.nz/etrace/). Specific usage examples are beyond the scope of the article, but the general methodology is as follows: • Find the target i.e. perform a traceroute on a port that is considered “open”. This will indicate where the end target is. Based upon past experience you are unlikely to get a TTL response from the firewall itself in approximately 30-40% of situations. This is due to the rule base being locked down. • Find the firewall i.e. perform a traceroute on a port that is considered as “filtered”. This trace is likely to timeout before the target, the last successful hop being a router and the first “timed out” hop the firewall. This is based on the fact that most firewalls filter on their external interface and will drop a packet before issuing a TTL response. This should be performed on all filtered ports. 16
Network Security
“
The running of Nmap is an essential first step in assess-
”
ing a firewall
A lot of environments will filter the general chaff with ACLs on the upstream routers and leave the really complicated decisions to a firewall further down the chain. You will therefore find a series of filtering devices. The following example shows both a successful and unsuccessful TCP traceroute:
X . 0 8 T e c a r t # ] o r t s h l a c o @ t r [ Starting tcp/80 trace to X.X.X.X 8: (A.A.A.A) [TTL Exceeded] 9: (B.B.B.B) [TTL Exceeded] 10: (X.X.X.X) [SA] [root@localhost root]# etrace -T81 X.X.X.X Starting tcp/81 trace to X.X.X.X 8: (A.A.A.A) [TTL Exceeded] 9: (??) [Timeout] 10: (??) [Timeout]
From these results it would be fair to say that the first device to drop packets is located at hop 9, which is the device immediately prior to the target. Further test probes would confirm if this is the only filtering device protecting the network. The next stage of testing is to confirm the nature of the filtering device. The key aspect is to determine if it is monitoring the state of the communications or just behaving as a dumb router:
[root@localhost root]# hping2 -S -T -p 80 X.X.X.X hop=13 TTL 0 during transit from ip=A.A.A.A name=AAAA hop=13 hoprtt=182.4 ms hop=14 TTL 0 during transit from ip=B.B.B.B name=AAAA hop=14 hoprtt=182.4 ms hop=15 TTL 0 during transit from ip=X.X.X.X name=XXXX hop=15 hoprtt=183.2 ms [root@localhost root]# hping2 -SA -T -p 80 X.X.X.X hop=13 TTL 0 during transit from ip=A.A.A.A name=AAAA hop=13 hoprtt=182.4 ms hop=14 TTL 0 during transit from ip=B.B.B.B name=BBBB hop=14 hoprtt=183.2 ms
In this case the sending of the SYN/ACK packet was dropped by the device prior to the target, but on a port that is open. It is pretty safe to assume the previously identified filtering device is performing some TCP state inspection. This is because a dumb router would let it through and you would receive a reset from the target itself otherwise.
Deeper still? The techniques discussed here are only the tip of the iceberg with regards to low level network assessment. But they are easy to use and provide information that is often valuable. When you craft your own data packets you could test load balancers and locate network IDS, which resets malicious packets. In fact your imagination is truly the only limit. In a security environment that rightly recognizes the threat of the comparatively new application oriented attacks, classical network oriented security is often wrongly overlooked. Don’t let it happen to you.
About the author David Morgan is a consultant at NGS.
January 2005
EMPLOYEE MONITORING
Is big boss watching you? Bruce Potter Like it or not, when it comes to the workplace, your computer is not your private domain. Your employer generally has the right to monitor what you type, what communications you send, and what data you store on your hard disk. While there are some boundaries that employers may not cross, in general the employer has carte blanche to monitor employees. But that might be about to change. This is the second of a two part series on workplace monitoring. Last month we focused on the tools available to intercept employee communications and to watch activity on workstations. This article focuses on the policies and laws governing workplace monitoring as well as the rights workers have.
Drivers for monitoring An employer may have many reasons to monitor the activities of an employee. While voyeurism and personal vendetta may be concerns for privacy advocates, they are generally not what motivates an employer. At work an employer provides IT resources for employees to use to do their job. Recent user surveys suggest that employees can spend several hours a day surfing the Web on non-work related tasks. Therefore an employer may wish to monitor staff to ensure they are actually doing their job and not something else. Of course, workplace policies vary on how much personal use of IT resources is acceptable, but in general an employer wants to know that the time they are paying for is devoted to real work. While it may sound like a great technical solution to worker productivity, this type of surveillance can have a negative effect on employees. When someone knows they are constantly being watched, they feel that they are not trusted and not valued as members of the team. This may cause them to become depressed, less productive, and potentially angry and destructive. If you are concerned with worker productivity and staff relations, then good old
January 2005
fashioned face-to-face management that spells out areas of trust and responsibility may be a better answer than electronic surveillance. Beyond watching staff to ensure they are actually doing their jobs, an employer can also determine if their resources are being used for illegal or immoral activities. For instance, it is not unknown for employees to exchange pirated music or videos over peer-to-peer networks using corporate facilities. Not only is this illegal for the individual, but it also exposes the employer to liability claims. It is not certain that a court would hold the employer legally liable for the actions of its employee with respect to piracy. But recent lawsuits from the MPAA and RIAA (and their international counterparts) are enough to make most legal departments uncomfortable. It is easier and cheaper to outlaw such activity in the workplace than to become the object of a lawsuit to test where legal liability lies. Finally, there is the issue of regulatory compliance. Many western countries have umbrella data protection legislation that goes some way to protecting information from unauthorized access and transport across national borders. In certain localities and types of industry, for instance health care and finance, there are stricter regulations that govern the types of data to which employees can and cannot have access. For example, in the US, the Health Insurance Portability and Accountability Act (HIPAA) governs access to private patient information. Under HIPAA, healthcare companies are required to comply with a variety of data protection
and operational security practices. As part of determining compliance, an employer may perform periodic or continuous monitoring of employees to watch for violations.
Compliance monitoring While HIPAA is a specific example, there is a trend to develop specific regulations to govern various industries. This is driving employers to keep a more watchful eye on their staff. The US has very few explicit laws that put privacy in the frame for a particular vertical industry. For instance, HIPAA governs the access of personal information in the healthcare industry and implies workplace monitoring for compliance. Similarly, the Sarbanes-Oxley Act of 2002 (SOX) governs the disclosure of information by publicly traded companies. SOX also implies that companies must monitor the workplace to determine compliance. Beyond these regulations, worker privacy and monitoring principles have been formed largely through case law. Basically, an on-going re-interpretation of existing worker protection laws by the judicial system attempts to keep pace with changing technology. And in most cases, the decisions support an employer's broad rights to snoop on their workers as long as it keeps in mind the company's best interests.
Vive la difference In general, the European Union's laws indicate a greater concern for the privacy of their citizens, regardless of whether they are in the workplace or at home. So, in practice, companies in the EU are slightly less intrusive in their monitoring. In June of 2004, the EU proposed a Workplace Surveillance Bill that would limit the actions an employer can take when monitoring workers. Under the bill an employer would need to notify an employee before it starts monitoring. The only exception is for a judge to authorize the employer to begin monitoring to catch an employee in the act of doing something illegal.
Network Security
17
VULNERABILITY ANALYSIS If passed, this bill will grant EU workers even greater workplace privacy than they have today, and far outpace the rights workers have in the US. The study1 examines some national laws in EU member states that provide other rights not included in the Workplace Surveillance Bill.
Workplace policy Even though the present laws and regulations tend to favour widespread monitoring by an employer, there are still best practices that employers should adopt. First and foremost, an employer should have a document that sets out their policy. The policy should state when an employee may or may not be monitored, what types of monitoring will be used, and what the ramifications of the monitoring may be. Even if the policy is all encompassing and indicates that the employee should have no expectation of privacy, this needs to be stated explicitly and the employee needs to sign a statement to the effect that they have read and understand the policy.
One important but oft-overlooked aspect of a monitoring policy are statements regarding the use of encryption by users. Encrypted data can render many network-based monitoring techniques useless. Even for stored data, such as email, encryption can prevent inspection and auditing. This can be particularly problematic when it comes to verifying regulatory compliance. Here encryption should either be prohibited or, if encryption is required, then a key escrow policy should be specified.
Parting shot Workplace monitoring of employee activities is not generally a comfortable topic for discussion; it speaks of a lack of trust and of Orwell's Big Brother. But it is an important part of modern business practice. Increasingly employers are watching their employees more closely, partly because non-compliance with relevant audit and regulatory practices can land the directors in jail, and partly
More holes than a phishing net Thomas Kristensen, chief technical officer, Secunia December 2004 started well when Microsoft issued patches for the IFRAME buffer overflow vulnerability. However, by the end of the month another system compromise vulnerability and a serious phishing hole had been discovered. No patches are currently available. http://secunia.com/SA12959
Forging SSL verification Some researchers found another hole, a sort of a magic wand, that made the scamsters’ dreams come true. The hole is caused by a vulnerability in an ActiveX component that allows a malicious web 18
Network Security
site to impersonate any other web site, even “forging” the SSL verification. The problem is that the browser technically visits the “good” web site and thus displays the address and SSL information of the “good” site in the address bar and the SSL padlock. The only problem is that the vulnerability allows other web sites to change what is being displayed in the browser. http://secunia.com/SA13482
Injection Another issue, known as the window injection vulnerability, has also been reported. This could be exploited by
because managers need to manage their resources efficiently. The present variety of technological methods for workplace surveillance leaves little for an employee to hide. However, the pendulum is likely to swing back. The political climate post 9/11 encouraged closer surveillance, but this may be changing as you read this. In Britain the law lords declared illegal or at least unwanted legislation that enables the detention without trial of foreign terror suspects. Intelligence failures with respect to 9/11 and the Iraq war have changed the climate of opinion as to whether more surveillance would prove more effective. It is quite possible that legislative bodies will tighten the circumstances under which workplace monitoring is permitted, with a general presumption of better protection for employee privacy.
References 1New
technology and respect for privacy at the workplace - http://www.eiro. eurofound.eu.int/2003/07/study/TN030 7101S.
scamsters to hijack certain browser windows. However, this is actually a legitimate function in the browsers, or so it was thought because all browsers have always behaved that way. Only after an on-line test was made available by Secunia did some of the browser vendors acknowledge the function to be a security issue. Secunia has constructed a test, which can be used to check if your browser is affected by this issue. To download it please go to http://secunia.com/multiple_browsers_ window_injection_vulnerability_test/ Please refer to the test above, or the Secunia advisories below for additional details. http://secunia.com/SA13251/ http://secunia.com/SA13129/ http://secunia.com/SA13253/ http://secunia.com/SA13254/ http://secunia.com/SA13252/
January 2005
SPYWARE http://secunia.com/SA13402/ http://secunia.com/SA13356/ http://secunia.com/SA13412/ http://secunia.com/SA13418/
LoadImage vulnerability Another vulnerability, which can be exploited to compromise almost every single branch of the Microsoft Windows operating systems, has been reported. The vulnerability is caused due to an
integer overflow in the LoadImage API in the Windows kernel. Currently, no vendor solution is available for this vulnerability. http://secunia.com/SA13645/
Macintosh Apple has issued a new Mac OS X Security Update, which fixes multiple vulnerabilities.An extensive round-up of the vulnerabilities is available in the
Pervasive spyware Berni Dwan delves into spyware in all its multiple guises and how it can be detected and stopped. The only feasible answer to stamping out spyware could be using an Apple Mac. This has been suggested by Frank Coggrave at network monitoring firm, Websense. It would seem that the Apple Mac – that object of beauty – is not deemed to be worth attacking by cyber criminals because only 2% of surfers use it. So using an Apple Mac online might be the next best thing to using a PC offline if you want to be left unscathed. Neither is Mozilla Firefox seen as a worthy victim – yet, most likely because it does not have the massive market share that Internet Explorer has despite its ActiveX vulnerabilities. Indeed, Microsoft blames spyware for over half of all application crashes. Just wait for FireFox to increase its popularity though and the spyware code writers will get busy.
Internet banking Websense found spyware on 92% of PCs in an April study of firms with more than 100 employees. “Spyware can be used for identity theft. Specific key loggers wrapped into spyware will also gather screen images and mouse clicks – even on secure Internet banking sites. A secure Internet banking site is not about the security of your PC, it’s about the security of the bank’s network. If you really need to do Internet banking
January 2005
or online purchasing using your credit card”, says Coggrave, “then use an office-based computer since it will be far more secure.”
P2P is bad news Another unwitting conduit is P2P. Its usage has increased by over 300% in the last 12 months with KaZaa notching up over 85 million downloads every day. “Using P2P is like leaving your name and address on a burglar’s website”, says Coggrave. “There is no control, no anti-virus protection. All of the bad stuff you avoid in other ways gets in this way, opening back doors and undoing all your security precautions.” P2P also has some worrying statistics associated with it. 73% of all P2P movie searches are for pornography and 24% of all P2P image searches are for child pornography, while 45% of shared files contain worms, viruses & Trojans. “Most corporates are not up to date on their policies”, says Coggrave. “In seminars I always ask if the policy has been changed to ban P2P and no hands go up. The pace of change is rapid and worst of all the first effective users of any new technology tend to be the bad guys. Thus it gets into the corporates before they’ve had time to understand the potential use of the
referenced Secunia advisory below. http://secunia.com/SA13362
SHOUTcast A vulnerability has been reported in SHOUTcast, which potentially can be exploited by malicious people to compromise a vulnerability system. The vendor has released an updated version, which corrects this vulnerability. http://secunia.com/SA13661/
technology and make decisions on how to manage it.” “Spyware can be blocked at the points – blocking the major Spyware generation sites (gator etc) and many tools do that”, says Coggrave. “You need to combine this with blocking the “back channel” traffic - that’s the stuff that is captured on the machines and sent out as Explorer data – often to bogus or hidden addresses. Finally you need to protect the desktop either by regular cleaning (using spybot etc) or by blocking bad application execution. Tools exist to do all these things and you need to protect at all the points to ensure a safe web environment.” “As with all corporates – some are good some are…. less good. The challenge with all the new threats is that they often pretend to be things they aren’t. For example P2P programs normally communicate across a specific port or connection point, and corporates should be able to stop this type of traffic by blocking or closing down that specific port to the outside world. These programs, if blocked, then try and find other exit points and pretend to be other applications (like Explorer) to get past the controls. Therefore corporates need to do more than just use firewalls and to really inspect all the outbound data flows deeply. Products like ours do that and we also make sure the “defenses” are up to date with the type of applications and ports the rogue programs try and use on a daily basis. This effects all the bad stuff – personal file storage systems like Yahoo, P2P, Instant messaging etc.”
Network Security
19
CALENDAR
Bullish British SMEs poised to splash on IT security Brian McKenna ne quarter of UK small businesses plan to increase spending on IT security in 2005, compared with four per cent in Germany.
O
These were two of the findings of an HP survey into IT security in European small and medium businesses carried out by Benchmark research in October 2004. The results were collected from executives in 300 firms in the UK, France and Germany. Security is, however, a top concern for 56% of German companies, while 62% of UK companies neglect it in favour of return on investment and cost control. So, increased British spending may conceal a less secure IT environment. And around half the companies across all three countries have been exposed to virus attacks in the last year. The Brits are also on the verge of spending more on IT in general in the coming year, particularly in the UK
where 77% of respondents say spending will definitely increase next year, and 37% expect that increase to be in double figures. This optimism is not shared by the French market, where only 44% of companies expect spending to increase. Germany is the most pessimistic market in this respect with 54% seeing no prospect for an increase in IT spending. British small business people emerged from the survey more bullish than their German and French counterparts. Eighty per cent of UK SMEs believe their business prospects are now better than last year, compared with 45% in Germany and 46% in France.
Jail for bug finding researcher? Nova Dudley-Gough n 2001, a French security researcher found vulnerabilities in antivirus software produced by French security company Tegam.
I
He published his findings online under a pseudonym in 2001 and again in 2002.
Tegam's reaction? To prosecute him for copyright violation. The case finally came to trial in January 2005, with an impact that may be felt by many in the security community. If the court decides that independent researchers cannot publish flaws in software, then it is possible that security companies will be able to sell products with wildly inflated claims - and there will be no one independent to verify them, or even to point out where they are going wrong. The researcher, Guillaume Tena, who worked under the pseudonym Guillermito, now faces a suspended jail sentence and a fine of Euro 6,000. Tegam, meanwhile, are asking for a further fine of Euro 900,000 by also pursuing a civil case against Tena. Tena upholds the fact that he is entitled to point out flaws in a programme that claimed to stop 100% of viruses, without having to receive publishing approval first. While at the moment this is only relevant for French law, the concern may be felt internationally.
EVENTS CALENDAR 24-25 January 2005 COMPUTER & INTERNET CRIME Location: London, UK Website: www.cic-exhibition.com
26-28 January 2005 IT-DEFENSE 2005 Location: Cologne, Germany Website: www.it-defense.de
10 February 2005 SecureLondon 2005 Location: London Website: www.is2.org
14-18 February 2005 RSA CONFERENCE 2005
20
Network Security
Location: San Francisco, USA Website: http://2005. rsaconference.com/us
16-17 March 2005 BUSINESS CONTINUITY - THE RISK MANAGEMENT EXPO 2005
29 March - 1 April 2005
13-15 June 2005
BLACKHAT EUROPE
CSI NETSEC
Location: Amsterdam, The Netherlands Website: www.blackhat.com
Location: Scotsdale, Arizona USA Website: www.blackhat.com
23-28 July 2005 5-6 April 2005
BLACKHAT USA
E-CRIME CONGRESS
Location: Las Vegas, USA Website: www.http://www.gocsi.com
Location: London, UK Website: www.businesscontinuityexpo.co.uk
Location: London, UK Website: www.e-crimecongress.org
29-30 March 2005
26-28 April 2005
14-16 November 2005
ECCE E-CRIME & COMPUTER EVIDENCE
INFOSECURITY EUROPE
CSI 32nd ANNUAL COMPUTER SECURITY CONFERENCE & EXPO
Location: Monaco, France Website: www.ecceconference.com
Location: London, UK Website: www.infosec.co.uk
Location: Washington, USA Website: www.http://www.gocsi.com
January 2005
