Linux Security Week: April 24th 2006

Raw code for "unbreakable" encryption, based on the principles of quantum physics, has been generated at record speed over optical fiber at the Commerce Department's National Institute of Standards and Technology. The work, reported today at the SPIE Defense & Security Symposium in Orlando, Fla.,* is a step toward using conventional high-speed networks such as broadband Internet and local-area networks to transmit ultra-secure video for applications such as surveillance.

news/cryptography/code-for-unbreakable-quantum-encryption-generated-at-record-speed-over-fiber

In a press release today, Redspin, an independent auditing firm based in Carpinteria, CA, suggests that the recent mandated upgrades of ATMs to support triple DES encryption of PINs has introduced new vulnerabilities into the ATM network environment - because of other changes that were typically made concurrently with the triple DES upgrades.

news/cryptography/triple-des-upgrades-may-introduce-new-atm-vulnerabilities

I'm jealous. No seriously. If Cigital is actually ran as depicted in the book Software Security - Building Security In, I have to give kudos to Gary and the gang for making an impressive environment for software security. I'm a fan of Gary's writing. If you are a regular reader, you know I loved both his books on Building Secure Software and Exploiting Software. This latest book is, in my mind at least, a balancing act between the two previous books on the topic. Gary calls it the "Ying and Yang". Which makes total sense, since the book cover is of exactly that, a white hat and a black hat (taken from the other two books), positioned in the chinese ying/yang symbol.

Backdoors, pharming, phishing, rootkits, viruses, worms. Feeling vulnerable? CNET News.com's Joris Evers and CNET.com's Robert Vamosi tell you about the latest security threats, what's coming, and how to protect your system.

Conventional wisdom says that powerful individuals drive open source by working against the grain to institute a methodology of sharing that would balance the power between software vendors and users. While this makes for an entertaining narrative, there is quantitative evidence to the contrary. The reality is that placing too much emphasis on individual players in the open source movement ignores overarching economic trends that drove open source development and adoption.

If you haven't checked out Endian Firewall yet, download the code and give it a try. Endian Firewall is a packaged Linux security distribution that combines several open source firewall, VPN and anti-virus packages with a hardened Linux operating system. There are many Linux security appliance packages out there, so Endian is hoping to differentiate its distribution with ease-of-use management and set-up features. According to the developers' Web site, the "turn-key" package was created with "usability in mind ... without losing its flexibility." A set of browser-based wizards is used for setup, configuration and maintenance, and the software can be installed via the RPM package manager standard.

news/firewall/all-in-one-linux-firewall-touts-ease-of-use-advanced-features

Thanks to one of our readers, NewsForge has obtained a copy of the widely reported Windows/Linux cross-platform "proof of concept" virus. News reports thus far on the code have contradicted themselves: some reported the virus can replicate itself on both Windows and Linux, others saying it has a viral nature only on Windows. Testing by both NewsForge staff and Hans-Werner Hilse may reveal why the confusion.

Linus Torvalds has had an opportunity to examine the testing and analysis by Hans-Werner Hilse which we reported on yesterday, and has blessed it as being correct. The reason that the virus is not propagating itself in the latest kernel versions is due to a bug in how GCC handles specific registers in a particular system call. He has coded a patch for the kernel to allow the virus to work on even the latest Linux kernel.

Flexible military communications have always been of great importance, and flexibility here stands for securely communicating over insecure channels -- IP based communications. While you might have not heard of Bantu before, to me their real-time network for interagency communication sounds more like a security through obscurity approach -- temporary gain and possible long term disaster.

news/network-security/qim-meq-a-strike-order

Nmap ("Network Mapper") is a free open source utility for network exploration or security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap runs on most types of computers and both console and graphical versions are available. Nmap is free and open source.

news/network-security/top-15-securityhacking-tools-a-utilities

This paper outlines a Distributed Denial of Service (DDoS) attack which abuses open recursive Domain Name System (DNS) name servers using spoofed UDP packets. Our study is based on packet captures and logs from attacks reported to have a volume of 2.8Gbps. We study this data in order to further understand the basics of the reported recursive name server amplification attacks which are also known as DNS amplification or DNS reflector attacks. One of the networks under attack, Sharktech, indicated some attacks have reached as high as 10Gbps and used as many as 140,000 exploited name servers. In addition to the increase in the response packet size, the large UDP packets create IP protocol fragments. Several other responses also contribute to the overall effectiveness of these attacks.

news/network-security/dns-amplification-attacks

I've been a big fan of honeypots ever since I first learned about them in Clifford Stoll's The Cuckoo's Egg. His story about catching German hackers because of a 75-cent accounting error is a thrilling forensics journey. Today, I support honeypots because they are a must-have early-warning tool in any organisation. If you can't stop the hacker or malware - it's hard to be perfect all the time - the next best thing is early warning. Placing a honeypot within your enterprise network, next to other valuable assets, assures that any rogue outsiders - or insiders - will be discovered quickly. If the hacker or malware touches the fake asset, it's done. Low cost and low noise equals high value.

It is important to understand the concepts of a database before one can grasp database security. A generic database definition is "a usually large collection of data organized especially for rapid search and retrieval (as by a computer)" (Database). This is not much different than Oracle's database definition, "An Oracle database is a collection of data treated as a unit. The purpose of a database is to store and retrieve related information." (Oracle Corporation) Databases can range from simplistic to complex. An example of a simple database is an address book. An address book provides great functionality but limits itself to specific information. For example, what if you need to include information about the model car the contact drives, or what their favorite food is? Chances are you would need another database. In a business environment it does not make sense to maintain multiple hard copy databases. Businesses must maintain large amounts of data. Examples of data are inventory, finances, payroll, employee information, and sales history.

news/server-security/oracle-database-security

Attack code that takes advantage of a flaw in Oracle's database software has been released on the Web, raising the urgency to patch. The exploit code was published Wednesday, only a day after Oracle released its quarterly Critical Patch Update, security provider Symantec said in an alert to users of its DeepSight intelligence service.

news/server-security/attack-code-out-for-oracle-database

What you don't know about the security of your information systems can hurt you and probably already has. But how much information about security flaws is too much? Anything you're told about a software vulnerability, the villains surely will pick up, too. Most people who manage information security say bring it on, subscribing to the belief that the more details they have about vulnerabilities, the better prepared they will be. They count on not only the software vendors' official security advisories, but also on researchers who specialize in analyzing products for flaws.

There has been a significant shift recently in the sophistication of network attacks as these morph from unstructured to structured threats. Users not only face a broader variety of security challenges but also have a tougher time in dealing with them in a cost effective manner. Those organisations which found that they were unprepared to deal with unstructured threats will have no hope now that the ante has been raised.

Security watchers have uncovered proof-of-concept (POC) malware that's capable (at least theoretically) of infecting either Windows or Linux PCs. Linux-Bi-A/Win-Bi-A is written in assembler so it is capable of infecting either Linux ELF binaries or Windows exe files. The virus only infects files in a user's current directory and isn't spreading. The code for Bi-A is simple and its only action is to inject text strings into infected files. Bi-A poses no immediate risk to users in its present form.

Since e-mail standards won't be of much help, we'll have to deal with phishing through private, complementary services. Which will be the big guns? This week's E-mail Authentication Summit in Chicago on April 19 reminds me of the Internet community's failure to agree on an authentication standard. Efforts such as this meeting notwithstanding, the whole authentication movement has been a flop, and that's a shame.

Attacks designed to bring down networks are largely under control, even though companies still spend plenty of time defending against them. The latest addition to IT teams' worry lists: keeping Web apps from being hijacked and forced to give up data that can be used to commit identity theft or other crimes. The number of Web sites with applications vulnerable to these attacks appears to be small--58 were reported last year to the Web Application Security Consortium, a group that tracks flaws found in custom Web apps. But that's a big leap from the 16 in 2004 and nine in 2003.

Personalization is a great featureâ€