Frames And Bits - The Andrew Storms Blog

Weekend Frame - Prickly Bits

Sometimes the scariest things are the ones out in plain view.

Last week of the quarter is just around the corner. 
Careful what you reach for, it might bite back.

Camera: Nikon D70s
Exposure: 0.017 sec (1/60)
Aperture: f/5.0
Focal Length: 55 mm
Exposure: 0.00
ISO Speed: 400
Exposure Bias: 0 EV
Flash: No Flash

Doing Business With Heartland; Regaining The Trust

According to a computerworld article and a statement by Heartland, competitors of the now PCI-delisted payment processor are using the breach as means to lure their customers.  Competitors are apparently suggesting that doing business with Heartland will result in fines from Visa.  That part is not true.  Visa has publicly stated that no fines will be levied against Heartland’s customers.    However, would you continue to trust Heartland, its auditor and the PCI compliance standard to do their jobs in protecting your information?

Without casting doubt on Heartland, this is a case where past performances may be sings of future returns.  Heartland continues to stay on message that they will be re-certified by May.  It’s also unclear if Trustwave, their prior PCI auditor, will be the ones re-certifying them.  The biggest question of all: when will they come entirely clean with their incident findings and how can they regain our trust?

In any economy it’s a natural force of doing business to use your competitor’s weaknesses against them.  Despite assurances from Visa and Gartner, you can bet that Heartland’s customers are thinking seriously about switching processors.  If I had any say into what goes on at Heartland, I’d suggest a few moves to help regain customer confidence:

1. Use a new PCI auditor this time around.  Why use just one, how about two entirely different and independent audit firms.  Not to say that TrustWave didn’t do their job, but take all doubts off the table immediately.
2. Invest in an automated compliance and audit system.  Being compliant once a year is not compliant at all.  This is particularly the case if you consider the mass volumes of transactions at Heartland – 100 million a month.  Compliance is much like a new car.  Once you drive it off the lot, it depreciates at a rapid rate.  For most computer assets, once they go into production, they will naturally migrate out of compliance.
3. Provide an honest and complete incident report to the public.  Let the public and the customers decide how the incident was handled and who is best to handle the next breach.  Breaches happen all the time.  What separates the field is 1) how well the company strategically positioned their assets against a breach and 2) how well the breach was handled and 3) how the company moves forward based on what was learned from the breach.

In the end, lets all hope that this breach will be a learning event for Heartland and all businesses.

Weekend Frame - Squares

Sometimes all your corners look squared up.  Upon second look, things are not as they seem.

Speaking of recursion, on Friday night I attended the LongNow talk with Daniel Everett. "The Pirahã, a remote Amazonian tribe with little outside contact, have attracted the attention of mainstream media, scientists, zen buddhists, professors of religion, mathematicians, philosophers and others because of their unusual confluence of values, language, and culture." 

Part of the synopsis by Stewart Brand:

"The Pirahã tribe in the heart of the Amazon numbers only 360, spread in small groups over 300 miles.  An exceptionally cheerful people, they live with a focus on immediacy, empiricism, and physical rigor that has shaped their unique language, claims linguist Daniel Everett.
The Pirahã language has no numbers or concept of counting (only terms for "relatively small" and "relatively large"); no kinship terms beyond immediate children and parents; no "left" and "right" (only "upriver" and "downriver"); no named distinction of past and future (only near time and far time); no creation stories or myths; and---most important for linguists---no recursion.
A recursive sentence like "The boy who was fishing owned the dog" does not occur in the Pirahã language.  They would say, "The boy was fishing" and "The boy owned the dog."  The eminent linguist Noam Chomsky has declared that recursion is an essential part of human language and is innate.  Chomsky's former student Everett says that the Pirahã language proves otherwise.  The resultant controversy is profound."

Another Twitter Breakin? Guy Kawasaki's Twitter Stream Looks Unusual

For most of today, Twitter seemed to have been sporting the "Fail Whale" of over capacity.  However, more interesting was the Guy Kawasaki twitter stream.  At about 3pm Pacific, users starting seeing some strange tweets.

"How am I in gk's account?"
"I am the all powerful guykawasaki coming to you live via adjix"
"wtg @sswayze ! you're right #friedchicken is the biz. shouts to @kfc_col , @knownhuman, @froggie775 and the rest of the #friedchicken crew."
"http://adjix.com/hhk5 Ad: Free $25 Starbucks Card! http://is.gd/nK6d"
"now that I have your attention, it would be super if you could help us all trend #friedchicken it's time has come friedchicken.alltop.com"

By all regards, something unplanned happened or is happening.  Clicking one of those short URLs takes you to a blog posting by Mack Collier.  Mr Collier even received a comment on his posting, "Have you hacked into Guy Kawasaki's Twitter account? If not you, somebody who likes you has - multiple links to this post today ??"

A look at Guy's twitter page confirmed that the suspicious tweets were from a different twitter client called "Adjix" whereas his normal tweets historically come from TweetDeck.

Twitter already has a shady history of security issues including an administrator account breach back in January.  We will have to wait and see what happens.  Until then, most users are just enjoying the Fail Whale.   

UPDATE:

According to gawker.com, his account was indeed "hacked" after Kawaski accidentally broadcasted his twitter credentials at Adjix:

Yes, he told me, when I reached him at an airport, his account had been hacked, but it was probably his fault. "I was using a new service called Adjix, and I did something too fast," he told me. "I can't explain it." Sort of like Twitter.

Kawasaki then suggested I speculate that he faked the hacking to get more attention. He added that he loved the hacker's tweets about fried chicken, and would gladly add it as a topic to his website Alltop.com. See? Everything on Twitter ends up being about self-promotion.

Adjix president Joe Moreno, in an email, said that Kawasaki mistakenly broadcast his login credentials over the service, allowing a hacker to take control of his account.

Original Post: March 19, 2009 at 04:12 PM

Edit: March 19, 2009 at 8:00 PM fix a few typos.  Add info from Gawker.com

iPhone OS 3, amazingly boring

Wake me up when the iPhone OS version 3 demo-thing is done.  What happens when you release the most disruptive hand held technology?  Well, you have to continue to outdo yourself time and time again.  Apple’s preview today was a snooze.  Lets review the biggest new features.

Pushed content
This is actually as a result of the iPhone’s inability to run background apps.  Ever notice that when you exit Safari and to go read email, that the website doesn’t keep loading in the background?  Or how IM clients are web based and must be in the foreground.  Apple says that "pushed content" will fix that and provide a new medium for developers.

In-app purchases
You can now purchase content or add-ons from within an application.  Great idea.  "The first one is free."

P2P blue tooth
Great feature in a gaming device, a bit worrisome in an enterprise-level mobile platform.  Just what we need is yet another network-aware vector for attack.  Lets hope they did this one securely.  I can just imagine a new bread of blue tooth sniper rifles at DefCon.

Copy and Paste
Seriously enough, I have to believe that this one did take a while due to security concerns.  With attacks like ClickJacking and untrusted web content, who knows what kind of data is going to be selected and copied into a clipboard.  More than likely, that clipboard is part of the  underlying "off limits" operating system.  This could be new interesting attack vector.  Though, you would think that a feature that goes back to at least the 1980's would be more standard by now.

Whats Missing

• The platform still lacks enterprise-class policy compliance tools.  The current method for sending out configuration settings is cumbersome and prone to circumvention.
• Centralized accounting and auditing are not anywhere to be found.  Want to know how many SMS texts a user sent or who they called or what software is installed?  Accountability tools are missing.
• Data on the device is still not encrypted.  This alone will disqualify the device for many enterprises.
• What about the historical iPhone attacks that just utilized known bugs in open source software running on the device?  No word today if iPhone OS 3 will be kept up to date any faster to thwart these attacks.

Recent Press Coverage

A recap of selected articles where I was quoted in recent days.

Adobe issues critical PDF reader patch

GCN.com - ‎Mar 12, 2009‎

Windows Patch Aimed at Picture-File Vulnerability

Sci-Tech Today - ‎Mar 11, 2009‎

Adobe issues fix for zero-day Reader vulnerability

ZDNet Asia - ‎Mar 10, 2009‎

Adobe issues patch to block zero-day flaw

SearchSecurity.com - ‎Mar 10, 2009‎

Microsoft patches for GDI, DNS vulnerabilities

SC Magazine US - ‎Mar 10, 2009‎

Microsoft patches 'evil' Windows kernel bug

Computerworld - ‎Mar 10, 2009‎

Microsoft patches critical Windows kernel flaw
SearchSecurity.com - ‎Mar 10, 2009‎

Adobe Releases Patch on MS Patch Tuesday

As if IT security teams didn't have enough to worry about today, Adobe released a patch for their high profile zero day vulnerability in Adobe reader and Acrobat.  Patches for versions 7 and 8 of their software aren't available yet.

The story on this exploit started on Feb. 19th when ShadowServer posted information on a "0-date on the loose" and referenced a Symantec AV update from February 12th, indicating that the attack had already been in the wild.

Adding to today's confusion, US-CERT is now recognizing new attack vectors for the Adobe JBIG2 vulnerability.

Throughout this entire process Adobe has been slow to communicate and provide
useful information for security managers.  Even with the onslaught of  critical press and jabs from the security community, Adobe was late to acknowledge the vulnerability and later yet in releasing remediation steps.

Initially they promised a patch by March 11th, so most security teams have been holding their breath and sitting with white knuckles over the last few weeks while the bug received more attention.

Other teams started migration to the alternative, FoxIt.  In a moment of irony, FoxIt was
also found to be vulnerable to same bug.

I joked just this morning that all I needed to ruin my day was for Adobe to release their patch.

Having the patch early is a huge benefit, but releasing it on the same day as Microsoft's planned March patch spells disaster for enterprise resource planning, and it still leaves Adobe with a black eye for lack of communication.

Weekend Frame - Yosemite

Just got back from Yosemite.  Here is a frame from my blackberry camera.

This week is going to be busy.
Monday: Internal security training
Tuesday: Microsoft reboot
Wednesday: Expected Adobe reader patch for the 0day issue.

What is security transparency

Transparency is a common theme in politics and Wall Street these days.  The
2008 elections, dealings of TARP, financial institutions run a-muck are all places where we hear the word transparency bandied about on a daily basis.  While many security professionals speak about transparency when it comes to information security, very few definitions fit the overarching idea of transparency.  I believe that the time has come for information security professionals to both dig deeper and out of the idea of transparency to gain a better understanding of this concept.

What does it mean to be transparent with security?

Textbooks teach us that information security consists of the CIA triad;  confidentiality, integrity and availability.  When any one leg of this stool fails, then the entire equation falls apart. Transparency implies actions of openness and accountability.   Transparency doesn't imply success or failure of information security; it dictates actions at questionable cross roads.

Information security professionals already understand transparency but we don't use the term the same way economists or politicians use the phrase.  Information security people use our own synonyms such as disclosure, process and audit.  Each of these terms describes how security teams and companies should carry out transparency.  When the politician speaks of transparency he, assumes everyone knows what he is speaking about, and to some degree we do all understand the big picture concept of transparency in government.   The network security manager, on the other hand, trying to make the same point clear has a different problem.  He wants reliable and clear communications too.  He relies on always being told the entire truth and needs an open audit trail.  Because computer and information security professionals are accustomed to and rely on the transparent standards underlying Internet functionality, these principles have to carry over into every part of their professional lives in order for them to be successful.

 

The vendor's role in security transparency

A vendor can learn to be transparent, but it's a long process. Transparency is part of the culture, part of every business decision and part of a company's foundation.  Microsoft, once viewed as the poster child for insecure software and security opacity, has made great strides towards delivering a more secure and transparent products.

Microsoft's lifecycle with its December out of band patch, MS08-078, represents a classic case of true transparency.  On December 9th, the media began reporting active exploitation of a new bug in Internet Explorer.  The next day, Microsoft publicly acknowledged these reports by issuing Security Advisory 961051.  That advisory included mitigation and workaround information.  Microsoft continued to update the advisory another 4 times over the next few days.  On December 16th, Microsoft issued a notification that a patch would be released the next day.  On December 17th, users received the patch as promised.  Throughout that week, Microsoft continued to update the security advisory with a change log and speak with the press about the exploit, the vulnerability and it's recommendations.  If you look at that same security advisory today, you will still see the change log history and be directed to the patch information.  This was probably Microsoft's shining transparency moment for 2008.

That's not to say that Microsoft is not always a paradigm of virtue in transparency, but they clearly know what they need to do and at least on occasion they act on what they know.

What should other vendors learn from this lesson in transparency?

Acknowledgment
 The first thing Microsoft did was publicly acknowledged the vulnerability.  You could argue that Microsoft would not have publicly admitted the software fault if it had not already been public, but this misses the larger point.  Providing information about a privately held vulnerability when no patch is available only increases the risk to those affected.  

Workarounds 
The second thing Microsoft did was reduce the immediate risk to affected users by supplying a work around. Those of us in the trenches of information security recognize that risk comes in many forms. Managers always request mitigation provisions, even if they can't be immediately applied because mitigation steps provide other methods to help reduce the risk. Security Advisory 961051 included enough technical details that provided enough information to allow managers to understand the risk and decide which mitigation steps were required at each juncture.

Communications

Starting from the first advisory to the day of the patch release, Microsoft actively participated in public dialog about the vulnerability.  They continued to update the security advisory with new information, speak with the press and use their own blogs to help provide awareness of the issues and risks.

The Consumer's Role

Vendors take transparency seriously by treating their consumers with greater levels of respect and consumers also have a responsibility in this marriage. For a vendor to admit a flaw in their software with the potential for catastrophic security failure is very difficult and requires a huge commitment to transparency.  It's understandable for consumers to throw stones at vendors for flaws that should have been disclosed but weren't, it's another thing to double penalize them for admitting the flaw.  Consumers need to advocate for an active role in vendor disclosure.

This is a cross post from my company blog.

Recent News Coverage

A recap of selected articles where I was quoted in recent days.
(Lots of Adobe discussions recently)

Security Tip: Update Your Flash Player

SitePoint - ‎Feb 25, 2009‎

Adobe Flash Flaw Could Give Attackers Full Control

Sci-Tech Today - ‎Feb 25, 2009‎

Hackers exploit unpatched Adobe Reader bug
Computerworld New Zealand - ‎Feb 22, 2009‎