Linux Security Week: March 5th 2007

If you follow the media today, you might conclude that data encryption is everywhere. However, is this "good" encryption? A classic saying "Encryption is easy; key management is hard" illustrates one of the pitfalls that await those implementing encryption enterprise-wide or even SMB-wide. This article covers some of the other mistakes that often occur when organizations try to use encryption to protect data at rest and data in transit and thus improve their security posture.

news/cryptography/five-mistakes-of-data-encryption

Using a system without backups is like driving your car 100 miles per hour down a busy road the day after your insurance policy expires. Exhilarating, yes. But you know you're living dangerously. "No one should depend on a car, or a computer, without having at least the basic level of coverage," says W. Curtis Preston, an expert in data-protection systems and author of the new book, Backup & Recovery (O'Reilly). It's a fact that every computer user knows-in theory, at the very least-but one that often takes a back burner to other IT needs, usually for lack of funding or other resources. Preston, however, maintains that a small budget doesn't mean doing without backup.

IT administrators are racing to update systems ahead of the March 11 start to daylight-saving time (DST). Nobody's concerned about the firewall or antivirus software flaking out, but anxiety abounds over other potential security consequences.

news/network-security/early-dst-start-causes-security-heartburn

If you weren't worried enough about the security of your home computer and network, it may be time to step it up. A new study by Indiana University and Symantec has discovered (and, alas, made more public) a new hacking technique called "drive- by pharming." Of course, we can't use a name actually in the dictionary, but the gist of it is that your home router may be insecure.

news/network-security/make-your-router-secure-right-now

Google Inc. has enhanced the way it notifies webmasters that their sites contain malware, improving on a service the Mountain View, California, company launched in November of last year in a partnership with The Stop Badware Coalition.

Google has begun providing more detailed alerts and to send these notifications via e-mail to webmasters, according to a posting Monday on an official Google blog.

news/network-security/google-sharpens-malware-alerts-for-webmasters

Despite improvements in code quality, Web servers remain at high risk of being hacked, according to a new paper from researchers who use honeypot technologies to examine how hackers tick.

The Honeynet Project, which provides real systems for unwitting attackers to interact with, says Web applications remain vulnerable for host of reasons. These include poor-quality code, the fact that attacks can be performed using PHP and shell scripts (which is generally easier than using buffer-overflow exploits), and the emergence of search engines as hacking tools.

news/network-security/why-your-web-apps-are-sitting-ducks

In technical terms, a honeypot performs a function very similar to that of a "honeypot" in the outside world: a sweet lure. A "honeypot" is a system designed with the purpose of attracting the attention of prospective attackers, to assess how they are attempting to infiltrate the machine and what they doing once they gain access. There are literally thousands of honeypot networks and systems setup by security professionals and hobbyists worldwide. These systems can provide a wealth of information into forensics and assessing trends in network intrusion.

MARCH 1, 2007 | ARLINGTON, Va. -- Black Hat DC -- Experts agree: The best way to secure applications is to build security in during the development phase. The problem is that there are few standards or templates for doing it.

But that situation is about to change, according to speakers at the Black Hat conference here today. In fact, draft guidelines for specifying common security weaknesses and common attack patterns could be just weeks away.

news/security-projects/getting-to-know-the-enemy-better

In the end, it's all a big guessing game. You create passwords to protect your systems; hackers try to guess the password you created.

It's a game that's going on all the time. As we reported last week, researchers at the University of Maryland recently completed a study in which four live Linux servers were set out as bait to see how often they would be attacked. The study racked up 269,262 attempts in a 24-day period. (See Study: Two Hacks a Minute.)

With the constant growth of the Internet, more and more web applications are being deployed. Web applications offer services such as bulletin boards, mail services such as SquirrelMail, online shops, or database administration tools like PhpMyAdmin. They significantly increase the exposed surface area by which a system can be exploited. By their nature, web applications are often widely accessible to the Internet as a whole meaning a very large number of potential attackers. All these factors have caused web applications to become a very attractive target for attackers and the emergence of new attacks. This KYE paper focuses on application threats against common web applications. After reviewing the fundamentals of a typical attack, we will go on to describe the trends we have observed and to describe the research methods that we currently use to observe and monitor these threats. In Appendix A, we give actual examples of a bot (a variant of PERL/Shellbot), the Lupper worm and an attack against a web Content Management System (CMS) as examples that show how web application threats actually act and propagate.

Companies in a recent study said they expect to be hit by at least one major IT incident that disrupts business, and business process controls are still lacking in many organizations. According to the Symantec IT risk management report, more than 60 percent of respondents expect at least one major IT incident per year that could halt or disrupt a critical part of the business. Conducted over a 12-month period ended October 2006, the study sheds light on the critical elements involved in an effective IT risk management strategy.

This article examines the dismal state of application-layer logging as observed from the authors years of experience in performing source code security analysis on millions of lines of code. It argues that effective logging is often ignored in the push for application security and demonstrates how applications can benefit from a real-time detection of attacks. An idea of a practical implementation is discussed, along with an examination of some of the associated risks and costs.

Don't get her wrong