I’m more in #ShellShock about the speed of the attackers !

If you haven’t caught up with it yet, there is a vulnerability out there which is quite a serious one.

What’s gone wrong now ?

If you have Linux, Unix or Mac OS X then you need to keep your eyes out for updates … and then learn how to test them for vulnerabilities !

 

So this is the issue … Bash. It’s in all the languages above and this is the problem with it :

I’ve given you a couple of links so you can get some breadth on the issue …

  1. Troy Hunt (LINK)
  2. Threatpost (LINK)
  3. CVE-2014-6271 (LINK)
  4. Akamai (LINK)

Well, am I affected ?

So yeah – that’s a biggie hey ?

Plenty of vendors have jumped on the scanner side of things to see if you are vulnerable :

  1. Errata Security (LINK)
  2. WebSecurify (LINK)
  3. Nessus (LINK)

Please note – you should use any tools you find on the internet with caution … only choose those you know or have been recommended by a competent security professional.

 

OK, you’ve probably ran that and found you are vulnerable. Yep, bad times ahead, I’m afraid. For those with multiple systems, it’s going to be a long night in the office.

Woah, so how do I fix it ?

Well it looks as simple as running update manager

  1. Update Manager (LINK)
  2. Ubuntu (LINK)
  3. Command line : apt-get update; apt-get upgrade; (Thanks to Matthew Pettitt for that ! LINK)

But … you said !

Disclaimer – this may fix this bug but could break everything that you were running, there may be a reboot and you never see your system again … backups please ladies and gents …. backups and test restores please.

OK, I’m still alive – now what ?

Test again … yes that’s right, check it’s been applied properly. (see section above !)

Phew, no problems here then !

Well not quite …

There is this bypass to look at :

bypass #shellshock patch: X='() { (a)=>\’ bash -c “echo date” creates ./echo with contents of `date` output

 

Oh and also – keep an eye out for the bots that have been trying to gain access for the last 24 hours !

  • What ?!! there’s already an active bot for this ?!! (LINK)
  • Yeah – there’s also this reverse shell too (LINK)
  • Oh and this daemon that reboots machines (LINK)

And is that it ?

Well essentially yes for now but keep a lookout on Twitter as there is sure going to be some big problems ahead which may be coming as a result of this. If you aren’t sure then go get some help … it’ll be on the news shortly so your boss will be OK by then to talk to you about it and will understand it. If you need a quick analogy … tell him we’re screwed and you’re going to resign. It’s easier than trying to fight the management team to try to get it fixed !!

 

The take away :

As technology becomes more pervasive and integrated into our lives and as some systems come to the fore, so the patching of those technologies has to be thought about. In this situation there are going to be some systems which simply cannot be patched. There will be some embedded systems, legacy Unix boxes etc which simply will not be able to be updated. The criminals were able to create an exploitive bot within hours while we were still warming up the PR departments to draft a catchy logo and first blog. The attackers yet again beat us. Add in to the mix the TVs, routers, medical equipment, SCADA systems and other devices yet to be discovered, we’re in for a bumpy ride – make sure you do your bit to keep the internet safe.

When a bug goes viral.

It was 3pm GMT when a 19-year-old Austrian nicknamed Firo was sending a tweet. There were millions of us tweeting too and his actions were not unusual. As he typed his tweet, he inserted a heart character and noticed that two appeared. Curiosity got the better of him and he started playing with his tweet. His discovery was that he could insert code into his tweet and yet it was only showing his love heart.

 

The thing about Twitter is that it attracts like-minded individuals together. When Firo’s followers received his tweet in Tweetdeck, they got a pop-up box with some text in it. When they re-tweeted it, so did their followers and so we see an initial growth. Firo knows computing, his friends know computing too and their circles are all in the same areas. After 30 minutes, the UK was receiving these curious messages and word was out…

 

XSS in Tweetdeck

 

When the tinkerers saw what they could do with simple script, they had a field day sending funny messages over Twitter. As the Tweets grew, so did the curiosity, Firo was past playing with the bug and the message was spreading. Within 2 hours, Tweetdeck was almost becoming a ghost town as the message sank in…

 

There is an XSS in Tweetdeck

– this is serious.

 

We shut it down, un-linked our Twitter accounts. Two hours after the initial finding of the bug, the users were savvy enough to understand its severity and was protecting itself.

 

Shortly after this was where we saw the self a propagating tweet. Using the same framework, it gave you the pop-up message but you automatically re-tweeted it. When this variant hit the BBC breaking site, 10.1 million followers received that tweet. Any using Tweetdeck automatically re-tweeted it. This was now a dangerous game and Tweetdeck pulled the plug.

A wise move by all accounts, had it been allowed to proliferate, Twitter could have fast become overrun and more harmful code code have been injected into a Tweet. Fingers were pointed to bad programming, the Twitter takeover and yes, I dare say the Governments probably got a finger pointed or two.

Bugs exist in code because we write code. Humans write code. We are not perfect. Bugs are found every day, some are low impact and some critical. A bug is simple to introduce by accident and can lay in some cases for over a decade (OpenSSL).

 

Firo did no wrong, he is a good definition of a hacker, he got curious and worked out what it could do. The media should not demonify him for his actions, in the same way Codenomicon should not be demonified for finding HeartBleed. Firo is a hacker. The media should learn that this is a good thing. He is not a criminal. Someone who finds bugs and has the intent to cause harm is a criminal. We need to separate these terms and this is a perfect opportunity.

 

Well done to the hacker Firo for finding this bug even if it was by accident (as most great discoveries are!).

We must also applaud Tweetdeck for such a fantastic and speedy resolution to the bug fix. I have no idea how many thousand lines of code they had to go through, but they did and they fix it.

I wonder what the next bug will be that is found today ?

I wonder if it will be in an 90s game that if you press IDDQD, IDKFA, IDCLIP ……..

 

Associated articles :
Original article identifying Firo
Doom

Digital Freedom – the manifesto is launched

Mikko Hypponen and David Hasselhoff have appeared on stage at re:publica 14 and launched the new Digital Freedom manifesto.

The manifesto is based on 4 points :

  1. Freedom from mass surveillance (target / blanket)
  2. Freedom from digital persecution (privacy in the future)
  3. Freedom from digital colonisation
  4. Freedom of digital access, movement and speech

 

I watched the keynote with interest and have the following thoughts :

Freedom from mass surveillance (target / blanket)

I appreciate that there is a time and place for surveillance. CCTV watches our every move and our internet traffic is scanned for key words. To remove this I believe would be a mistake – but instead, they should be more transparent instead. Go ahead, watch me and scan me … but only if you do something useful with this data to keep me safer. Sure I have secrets and sure, I am aware of what I post … but can you imagine a world where facial recognition does not pick up the criminals ? I think that there is a specific use case for mass surveillance, but it is currently not being handled well and certainly not following the same standard of disclosure globally.

Freedom from digital persecution (privacy in the future)

This I understand and totally support. Right now, May 2014, it is OK to have certain views, prejudices etc, but in 2020, will those standards still hold. Will my old opinion still be the same ? I once thought I was going to be an electrical engineer – that didn’t work out, so why should the opinions I have still hold ANY weight in the future ? We need to isolate a case, sure, look back in history to see if it a long-held opinion, but certainly not to use it to persecute in the future.

Freedom from digital colonisation

The lines between technology and our existence are more blurred than ever. With the Internet of Things, mobile tech etc … we see more intrusion of technology into our lives. And it is just that .. an intrusion. We need to learn to adopt the divide between tech and life. Just because technology exists doesn’t mean we have to shoe-horn it into every day lives – especially if it is to the detriment of our privacy. We all need to learn to have down-days. Non-tech days … and if you don’t know the answer to a problem, instead of Googling it … use this method:

  • Brain – think about it, work out the options and the theory.
  • Book – read it in a book, they are more than paperweights !
  • Buddy – ask a friend, a colleague … the meat space !
  • Boss – ask a person in authority, your boss, a department head, a lecturer, they generally got there by knowing something !

Freedom of digital access, movement and speech

Should I be allowed to write what I want ? What about offending someone or prejudice ? Should I be restricted in what I can/can’t say ? I think this comes down to an old skill that we seem to have forgotten with the advent of technology – the art of common sense. So I would like to introduce you to Gran’s law. Think about an elderly relative (a Grand-parent for example). Now go ahead and type your real feelings about something you feel passionate about. If your Gran were to read it, would she be offended, clip you round the ear, would she be horrified about it … if the answer is yes, then it is probably best to keep it off the internet ! Common sense can save you a lot of conversations later. You should not be thinking about your intended audience but that the internet sees all.

 

What are your thoughts ? Have you posted on the Digital Freedom site ?

 

Security Mantras

I have to explain security concepts quite a bit in my job and so I thought I’d share my thoughts with you all for some discussion.

 

I’m going to keep it brief and then update this blog with the feedback and comments shortly.

 

Mantra 1

There are two kinds of people – those who have been hacked and those that don’t know it yet.

I’m all for a bit of FUD, Fear, Uncertainty and Doubt. It is a good sales technique to be fair – but please, if you are going to use FUD, be accurate. The infosec is getting a bad rap for wild accusations so let’s keep it real. If you feel the need to use a FUD mantra – how about:

Do you want to be one of those companies that you get to read about who didn’t do anything and then got hacked.

 

Mantra 2

Monitor, Manage and Maintain

Bit of a personal favourite of mine – so for transparency reasons … yes, I am biased!

  • Monitor – you have to be looking out to see what is coming your way. Ensure you have adequate monitoring that is telling you of an impending attack. Of course the critical part of all this is to know your base line – what is normal ? Once you know this, then you can work out what could be going wrong.
  • Manage – if you don’t have someone looking after these things, it goes the way of the paperless office … it was a good idea once. There should be a sponsor … a person at the top of the tree who ensures that the top line buys in, then there should be a busy bee worker who is making sure ‘stuff’ happens.
  • Maintain – patch, upgrade – do what you need to to ensure you are always at the edge and not falling in to the hands of criminals who love to capitalise on out of date systems

 

Mantra 3

We have [VENDOR PRODUCT] so we’ll be OK

or

Buy our [VENDOR PRODUCT] and you will be secure

No, no, no, no. No piece of tin will keep you safe. I love this quote which explains this perfectly “It doesn’t matter how thick your suit of armour is, you can still get flu.” With humans, there is always a will and a way !

 

 

So there you go …. my starter for 10 …. what security mantras do you use to protect yourself or what mantras do you train others in ?

 

 

Infosec in 2013

So it looks like we survived 2013! No comets came crashing into Earth, the zombies stayed and the sun didn’t explode.

It’s always at this point in the year we see those blogs – “Retrospective on 2013” Well to save you the bother of reading them, here’s a little tip. Everything in 2012 happened again but to various different degrees.

  • Instead of Sony being attacked it was Target
  • Instead of Wikileaks it was Snowden
  • Instead of 123456 being the most common password to be leaked it was … 123456

And herein lies the problem with information security.

We spend all year inventing new technologies .. Web Application Firewalls, APT threat detection, Cloud Based anti-DDoS solutions – the list of tin and “solution” is vast. As an end user you now have a bewildering array at your disposal. But does it work ?

Well .. to put it bluntly .. no.

  • It’ll never work when the user thinks to be safe I’ll use 123456 for a password.
  • It’ll never work when users post photos of their debit cards on social media.
  • It’ll never work when companies store credentials plain text.
  • It’ll never work when vendors can be swayed by $10million from the NSA.

You can surround yourself with as much defence and attack capabilities as you like but if you are compromised before you start then save your money.

So that was 2013 …

A lot happened and the infosec community cannot say we won this year. If anything .. we took a bad battering. Take stock of what you learned and face 2014 with new energies to this year get it right.
 
 

Start with yourself,

then your family,

then your friends,

then the company you work for.

Do something. Anything … but do SOMETHING.

 
 

Are you unconsciously insecure ?

Maslow is a well-known psychologist and came out with many theories and observations that are still relevant and used today.

One of his more famous ones was around learning.

  • Unconscious incompetence – you don’t know what you don’t know
  • Conscious incompetence – you know what you don’t know
  • Conscious competence – you know what you know
  • Unconscious incompetence – you don’t know you know it (think natural gift)

This got me thinking … I come across so many companies that get things wrong and when you ask them about the incident, they had no idea about how this vulnerability or issue would apply to their security. So here is Coulson’s theory to security types with more than a slight nod to Maslow!

1) Unconscious insecurity

They don’t know that their actions are causing them insecurity.
Passwords that are weak
Passwords on notes on their desks
Using public wi-fi for secure traffic
Full data on social media
Unencrypted databases
Updating/patching not being completed

Sound familiar? Well of course, what is more tragic is that we can remove a massive bulk of people out of this area into a higher area with better education. This needs to start at school and continue.

2) Conscious insecurity

We knew about it but didn’t have budget
Yeah, it wasn’t in scope
We had it on our to-do list
I wondered what it was
It won’t happen to me

Again, a high proportion of people live here and generally it is a resource issue to fix. Budget is a big player but so is also understanding the risks. A good approach here is to map out a process. I need to do some banking. If you understood the risks of public wi-fi, you wouldn’t go near it. So you need to understand the risks and budget (time and money) for those risks.

3) Conscious security

So long as ‘x’ happens then we’re ok
Audit will pick that up
We have that tested
If I follow this guide then we update everything

Yeah, not so many people live here. It is a concerted effort at this point. If someone has been attacked previously, they tend to be more conscious of their security and therefore take steps to protect themselves.

4) Unconscious security

We do that
That is an automatic process
Yeah, updates happen
We’ve never failed an audit yet
I always do that

This is the nirvana we seek! Yep, if everyone was in this area then less incidents would happen. But there is a problem here too … How do they know they are effective? How do you ensure you are up to date? How do you check?

So there you have it, Coulson’s theory of security! Thank you Maslow.

Summary of types :

Unconscious insecurity – I didn’t know
Conscious insecurity – One day
Conscious security – I’m ticking the boxes
Unconscious insecurity – Pah, I laugh at your security

Summary of fixes :

Unconscious insecurity – Knowledge
Conscious insecurity – Understanding
Conscious security – Taking steps
Unconscious insecurity – Effectiveness

Which one are you ?

Cybersecurity for Kids

How on earth do explain to my kids about staying safe online. Do I tell them about the nasty man who wants to see pictures ? Do I tell them about the naughty people hiding in the shadows that want my kids to open things for them so they can look at mummy and daddy’s computer ?

 

Where do you start ?

 

Well the first thing I have done is to create their own logins (with parental controls applied) so they are now masters of their own destiny. It is also easier for me to log their movements. They know this and understand that if they have any problems, they can trust me to be able to look into their situation.

So tip 1) Make them accountable

 

Next logging in – My eldest child is VERY possessive of their writing and so they deliberately made their password harder for their younger sibling to guess. Aged 7 using an 8 character password with upper and lower case, numbers and otherwise. Even my youngest child is using upper and lower case characters.

Tip 2) Complex passwords / pass-phrases

 

Once logged in, the parental controls help limit what they can/can’t browse. There are a multitude of these in the marketplace as well as those built-in to Microsoft Windows 7 / Live. Although it is only a basic step, it reduces the likelihood of them viewing content they shouldn’t be seeing. It is not infallible, but we are looking at reducing risk. Allow them some control though – again, it will help them to still have usability of the internet and therefore won’t try to circumvent any security.

Therefore tip 3) Use parental controls to reduce the risks of what your child will be viewing

 

If you want to know what your children are doing on the internet … sit with them ! Show an interest in their computer use, suggest other sites. Think of safe sites (BBC, National Geographical, NASA), research them first. Show them how to use Google and other search engines to find safe sites (SafeSearch on etc). A bit of time and effort at the start and you will be starting them off on the right foot.

Tip 4) Invest some of your own time to help protect your children

 

OK, so your kids are now logging on, able to use the computer. But how do you get them to keep this good practise. At some point you need to talk about the bad guys. For this, there are plenty of online resources to demonstrate the dangers without them actually falling foul. Also, consider discussing situations – what if you post X on a social media page – how will that look to teachers / potential employers etc. This will be an invaluable lesson and you need to think about how to do this. Think about talking to your child’s school for advice and perhaps. This will then give a common view and reduce confusion about right and wrong habits.

So tip 5) Educate them about the bad guys

 

What do you do if you if you suspect your child has done something on the internet that they shouldn’t ? The big question … well the first thing is to talk to them about it and explain what the outcomes may be. The primary discussion is about them removing content or otherwise you should not do it alone as they could rebel and upload more content. So if they understand why they should remove the content, it should help them in the future. Let’s face it, we all get it wrong  at some point, don’t chastise them, help them realise how they should behave.

Tip 6) Help them when they go wrong.

 

By no means is this list infallible, but at least it’s a start. I encourage you to comment and offer your own suggestions as to how you tell your children about being safe online.

 

Summary :

Tip 1) Make them accountable

Tip 2) Complex passwords / pass-phrases

Tip 3) Use parental controls to reduce the risks of what your child will be viewing

Tip 4) Invest some of your own time to help protect your children

Tip 5) Educate them about the bad guys

Tip 6) Help them when they go wrong.