The sense or nonsense of changing your password

By now everybody has caught on to the (presumed) LinkedIN breach, except the people at LinkedIN themselves but they're probably digging through their treasure trove of social big data in the cloud. However, the most heard comment today must've come from several people saying that it doesn't make sense to change your password because the attackers could just get it again. While not an invalid point, I believe it's the worst advice to give.

There are three main components to this attack :
1. finding the vulnerability enabling the attacker to extract the data.
2. extract the data
3. crack the password

Assuming your password was cracked, the attacker has succesfully performed all three steps. If you change your password now, the attacker will have to perform step 2 and step 3 again. Given that this was a wake-up call for you, you probably chose a much more complex password and thus making step 3 much much harder for the attacker. Even though the vulnerability was not fixed (yet), changing your password does make you safer.

A good analogy would be your seatbelt (I know it's old but it works ...). After a minor crash, you may finally make a habit of wearing your seatbelt. There is obviously still a (big) chance that you'd die in a major crash but it will be much less likely.

Update : 
Someone remarked that, if the attacker still has access to LinkedIN, step 1 and 2 become unnecessary. Especially if the attacker has access to the plaintext stage of chpass.  Obviously, we don't know how they got owned so any theory goes. I'm placing my bet on SQLi but in case it is worse than that, I might go back to my rolodex :-)

Rock on,
/W

a few honest questions about Flame ... answer 'em

While I invited some of the most vocal people on the issue of #flame to our humble podcast tonight, nobody actually stepped up to the opportunity to openly discuss the issue. Too bad, so I'll put out the random questions that are floating around my head right now that I can't find a good answer to.  If you have additional questions, I'm happy to add them to the list.

1) Microsoft, WHAT THE F- HAPPENED THERE ??? You're practically the only vendor that I've read sensible documentation on how to build a reasonably secure PKI infra from and now you come telling me that FOR ALL THESE YEARS any customer with a Terminal Services License was able to sign code, create MITM certs, etc.? If this actually was malware created by a "western intelligence agency" (see question 6 ;-)) you were pretty much thrown under the bus at terminal velocity.  Here's a *hug*

2) Infosec community, WHAT THE F- HAPPENED THERE ??? We're there when Google updates the certs blocked by Chrome to cry wolf on a forged gmail.com cert because that kills people but we succeed in missing a flaw that should be blatantly obvious in a product of a vendor that is probably the most scrutinized in the world?  (obviously, part of that blame is mine. I'm ashamed for the lot of us.)

3) AV companies, WHAT THE F- HAPPENED THERE ??? So yeah, samples dating back to 2010 (unsigned, I've learned by now) didn't trigger any of the automated triage systems you employ. If  we had triage systems like that in disaster situations ... WE WOULDN'T NEED TO BE LOOKING FOR SURVIVORS !

4) AV companies, WHAT THE F- HAPPENED THERE ??? Everybody's pushing out Flame-related content front, left and center but it doesn't even sound like you're all speaking the same languages. Is there actually any communication between you guys? Or is it each to their own and everybody trying to outrun eachother?

5) AV companies, WHAT THE F- HAPPENED THERE ???  So, Kaspersky got some major DNS providers to work with them and sinkhole domains identified to be related to the Flame malware.  So, are you guys aware of those actions? Do you guys tip each other off? Wouldn't it make sense TO DO THIS TOGETHER? WTH are y'all spending resources on analyzing that piece of malware and one of you is jokingly redirecting all C&C traffic to their own servers.  Seriously, last time I checked you needed a court order or you needed to be the US government to sinkhole domains.

6) US gov, Israel, WHAT THE F- HAPPENED THERE ??? Nope, I don't believe you guys are actually behind this one.  You're scratching your head in disbelief and are actually happy that people are attributing you with the leet skills needed to pull this one off ;-)

Forensics Training courses

yesterday I posted a question on Twitter to see what other training offerings there are out there in the area of computer forensics, beyond what we know is a quality offering from SANS.  Not because I don't like SANS but because I kinda knew everybody would start sending me SANS links and since I know their offering, I was mostly looking for others.  Here's what people came up with :

- EC-COUNCIL CHFI : http://www.eccouncil.org/Computer-Hacking-Forensic-Investigator/index.html

- Tigerscheme has malware and forensics courses : http://www.tigerscheme.org/qualifications/Tiger_Digital_Forensics_Certified_Incident_Handler.pdf

- CERT CC offers such a course : http://www.sei.cmu.edu/training/P107.cfm

- 7Safe offers such a course : http://7safe.com/forensic_investigation_course-technical_hands-on.html

- CFE is such a course : http://www.digitalintelligence.com/training/cfe.php

- TrustWave Spiderlabs offers personalized forensics training (no link to training curriculum available) : https://www.trustwave.com/spiderLabs-services.php

I'm looking for you ...

Let's see if this internet thingy really works ... Dear Claire, I'm looking for you.

This all may seem really silly but it is kinda important to me to follow through on this one.  While my friends and I were standing outside the Shelbourne hotel in Dublin, Ireland on Saturday April 21st you and your friends came out, ready to party.  While the conversation we had was short and could be regarded as random chatter, I remember you asking if the kids you worked with as a clinical psychologist could really do those things with computers they claimed they did. We discussed it some further and I promised you to get you in touch with local hackerspaces to see if those kids could channel their energy in a more 'positive' way. Obviously, I didn't write down your email address, neither did I leave mine at the reception desk as you asked.  You carted off into the night and there's a slim chance I'll ever know how to follow through on my promise ...

Here goes, if you know who you are and remember this conversation, get in touch through email at wremes[at]gmail[dot]com ... if not, at least I tried :-)

Cheers,
Wim

regulatory capture in infosec, by example

Note :
I have the utmost respect for the people to be named in this blogpost. I also have friends working for the companies to be named. This is in no way a hate or flame post but with the attention of legislators drawn to all things cyber our industry too will see regulatory capture emerge. I believe it is important enough to point out how it works and why it is bad.

Regulatory capture, as defined on wikipedia :

In economics, regulatory capture occurs when a state regulatory agency created to act in the public interest instead advances the commercial or special interests that dominate the industry or sector it is charged with regulating. Regulatory capture is a form of government failure, as it can act as an encouragement for large firms to produce negative externalities. The agencies are called "captured agencies".

Whenever legislation (or any regulation for that matter) is made, there are parties that have a significant economic interest in the affected area that will try to influence how exactly that law is worded. Sometimes these parties strive to minimize the impact of that particular legislation on their business practices, often through lobbying or otherwise influencing our representatives. Regulatory capture happens when such parties succeed in influencing the legislation process to their benefit.  There are ample examples (see the wikipedia entry) of how government agencies have been subject to regulatory capture. There have been, however, few examples pertaining to our industry, until this week.


On March 26th, Richard Bejtlich, CSO of Mandiant, testified before the U.S.-China Economic and Security Review committee. The full text can be found here. While an interesting read in itself, it is an interesting and textbook example of how regulatory capture manifests itself.  I will illustrate this by quoting paragraphs from the full text. You're free to form your own opinion by reading the text as linked above.


Mr Bejtlich starts by introducing himself :

I am Chief Security Officer at Mandiant, a private company that provides software and services to detect and respond to digital intrusions.

At this moment, this is no longer a personal testimony (which was also maybe never the intention but we are missing that context). Everything the committee hears from now on can, and should, be interpreted with the understanding that commercial interests are at stake. He continues to illustrate what Mandiant does, defines what they regard as APT (it's China, obviously) and how Mandiant detects APT actions. From there on it reads like a long blogpost on the latest M-Trends report. Even the case studies are very similar to those in the report. While I don't doubt the data used to build the report, the methodology used to interpret the data isn't known. I also don't have the faintest idea about the sample size. As the audience has no evidence to compare the M-Trends findings too, for the rest of the testimony the findings are the only truth. It goes downhill to where percentages are stated to illustrate the seriousness of the situation. Percentages, without any view on the sample size, are meaningless beyond the point of making your own truth.


Then there comes an interesting passage :

APT groups use the level of sophistication required to achieve their objective.  For example, in
2011 Mandiant observed an increase in the usage of publicly available malicious tools by APT
actors.

This one isn't related to the point I'm trying to make but as a legislator this would trigger the following thought: "Let's ban the possession, production and use of "malicious" tools."

I'm convinced that this was not the message Mr. Bejtlich wanted to convey. I believe that, as defenders, the ban of such tools would set us back lightyears.  

At the end of his testimony, Mr. Bejtlich runs into the end zone. He isn't here to inform, he's here to sell a product. More precisely he's here to propose that technology, conveniently produced by the company he works for, be required to be used ... by law :

To this end, I recommend Congress consider the integration of an “are you compromised” assessment into any new requirements levied on specific industries.  These assessments should occur no less frequently than once per year, although true continuous assessment on a 30-day cycle is much more effective in my professional judgement and experience.  By requiring processes and technology to answer the “are you compromised” question, regulators, Congress, and other appropriate parties will, for the first time, gather ground-truth knowledge on the state of security in selected industries.  Without knowing the real “score of the game,” it is unreasonable to expect real progress in digital security.

This, my friends, is a textbook example of attempted regulatory capture.  We have seen innovation in our industry stall by regulatory requirements in the past years. So much that the technologies that thrive are those that accomodate a particular compliance use case. While the positive effect for the commercial entity involved is obvious, the negative effect on the profession (and the entities that are subject to the legislation) are immense. 


Again, I am not criticizing Mandiant in particular. The technology they have developed is rad and if applicable to your situation I would suggest to check them out.  Knowing what and who I know within the organisation, I'm also convinced that their services are top-notch. The text as published merely serves as a perfect illustration of how regulatory capture works. I believe it becomes more and more important that we become aware of what it is and how it works. It remains to be seen how the testimony is interpreted and what the committee decides to do with the information.