Linux Security Week: May 22nd 2006

Hacker Adrian Lamo is in trouble again, this time for failing to give the federal government his DNA. On Tuesday, federal probation officer Michael Sipe filed a notice of violation in a Northern California court accusing Lamo of refusing to submit a blood sample, in violation of Sipe's instructions and a 2-year-old federal law. "He reported to the probation office as instructed; however, he refused to provide a blood sample for DNA testing, in violation of the general condition of supervision requiring compliance with federal law," the filing reads.

I was at CardTech/SecurTech 2006 recently and had a meeting with Cryptography Research, a company focused on securing smartcards. I spoke to Kit Rodgers, VP, and Ken Warren, Manager, about smartcard tamper resistance with differential power analysis countermeasures. Listen to the interview with Cryptography Research Listen Now

news/cryptography/differential-power-analysis-countermeasures

This two-part article series looks at how cryptography is a double-edged sword: it is used to make us safer, but it is also being used for malicious purposes within sophisticated viruses. Part two continues the discussion of armored viruses and then looks at a Bradley worm - a worm that uses cryptography in such a way that it cannot be analyzed. Then it is shown how Skype can be used for malicious purposes, with a crypto-virus that is very difficult to detect.

news/cryptography/malicious-cryptography-part-two

Researchers at Mitsubishi Electric, NEC and the University of Tokyo claim to have made a breakthrough in a new technique for very secure data communications. The parties have implemented a technique known as quantum cryptography, which codes the data optically and have for the first time transmitted information between systems uses this technique.

news/cryptography/total-computer-security-could-result-from-unbreakable-optical-code

SELinux is a mandatory access control (MAC) system available in Linux kernels as of version 2.6. Of the Linux Security Modules available, it is the most comprehensive and well tested, and is founded on 20 years of MAC research. SELinux combines a type-enforcement server with either multi-level security or an optional multi-category policy, and a notion of role-based access control. See the Resources section later in this article for links to more information about these topics.

Most people who have used SELinux have done so by using an SELinux-ready distribution such as Fedora, Red Hat Enterprise Linux (RHEL), Debian, or hardened Gentoo. These enable SELinux in the kernel, offer a customizable security policy, and patch a great number of user-land libraries and utilities to make them SELinux aware.

(Editorial comment: EnGarde Secure Linux is an SELinux-ready distibution)

It's a dangerous world. Every day, thousands of attacks that threaten to corrupt key systems, steal customer data, and otherwise abuse information-technology assets assault U.S. businesses. The SANS Institute, which provides computer security education and training, estimates that the average Internet network address experiences an attack every 24 minutes. In most cases, it's an unscrupulous hacker trying to infect corporate computers with viruses, worms and Trojans-commonly dubbed "malware."

Imagine how useful it would be to have an online knowledge base that can easily be updated created by key people within your organization. That's the promise of a wiki -- a Web application that "allows users to easily add, remove, or otherwise edit all content, very quickly and easily," as Wikipedia, perhaps the best-known wiki, puts it. Why not bring the benefits of a wiki to your organization? If you're sold on the concept, the first thing you need to do is to pick the software that you're going to use for your wiki. If you want hunt around to find out what's out there, a good place to start is Wikipedia's wiki software wiki. If you say, "I'll use whatever Wikipedia is using," that'll be MediaWiki.

Welcome to the first Help Net Security Podcast. We are going to be focusing on the enterprise and informing you on new products and technologies. While at the Infosecurity show in London we met up with Shirley O'Sullivan, the Security Leader EMEA at Nortel. In this podcast you can listen to her discuss their approach to security.

It's been a while since I've last blogged about Cyberterrorism, and while many did mentioned the topic in between the recent DRDoS attacks, Cyberterrorism is so much more than simply shutting down the Internet, namely the ability to communicate, research, recruit and use propaganda to achieve goals based on ideological beliefs, or the convergence of Terrorism and the Internet. Can we argue that cyberterrorism is the direct effect of techno imperialism, or let's use a more friendly word such as IT-dependent society and information infrastructure?

It's foolish to care if CISSP skills are being taught in colleges. Why? It's a moot point. But it does bring to light another, more serious issue, that of who really is an information security professional, and who may simply be masquerading as one. While some may worry that future employers of young potential CISSPs will be fooled by the lack of experience that these recent graduates will carry to their jobs, I say companies should know better. [Editor's note: Regardless of coursework or exam passage, prospective CISSPs are unable to obtain the certification without four years experience in the field, or three years with a college degree or equivalent life experience.] Unless a firm is making its first security hire, then it should easily be able to identify those who have what it takes to make it in the field versus those attempting to fool potential employers with mere "knowledge certifications."

Do anti-phishing toolbars in web browsers stop phishing attacks? No. Can they reduce them, even for savvy users? Yes. Are they all equally effective? No. MIT researchers found that users are highly likely to ignore anti-phishing toolbars... especially those designed to verify SSL certificates. The researchers installed browser toolbars without training the subjects in their proper use. Then subjects were asked to do various tasks requiring a username and password, like adding to a Wish List. The subjects incorrectly divulged usernames and passwords to the phishing sites 52% of the time. After users were dragged through a tutorial, successful Neutral Info toolbar spoofs dropped to 28% while spoofs of those using System Decision toolbars plummeted to 15%. SSL-verification users were fooled 35% of the time.

When was the last time your TV set crashed or implored you to download some emergency software update from the Web? After all, unless it is an ancient set, it is just a computer with a CPU, a big monitor, some analog electronics for decoding radio signals, a couple of peculiar I/O devicesâ€