TaoSecurity Blog

Longtime readers know that I have no problem with foreign countries replacing American vendors with local alternatives. For example, see Five Reasons I Want China Running Its Own Software . This is not a universal principle, but as an American I am fine with it. Putting my computer network operations (CNO) hat on, I want to share a few thoughts about the intersection of the anti-American vendor mindset with the recent Spectre and Meltdown attacks . There are probably non-Americans, who, for a variety of reasons, feel that it would be "safer" for them to run their cloud computing workloads on non-American infrastructure. Perhaps they feel that it puts their data beyond the reach of the American Department of Justice. (I personally feel that it's an over-reach by DoJ to try to access data beyond American borders, eg Microsoft Corp. v. United States .) The American intelligence community and computer network operators, however, might prefer to have that data outside Am...

The second of the three security principles listed in my first book is: Many intruders are unpredictable. I think the new Adobe Acrobat Reader vulnerability demonstrates this perfectly. (I'm not calling Stefano Di Paola an intruder; anyone who uses his technique maliciously is an intruder, though.) Who would have thought to abuse a .pdf viewer in such a manner? Read more about the problem here . This event reminds me of soccer goal security .

In January during the WMF fiasco, I wrote The Power of Open Source . What we're now reading in Zero-Day Response Team Launches with Emergency IE Patch is the latest evolution of this idea. The Zeroday Emergency Response Team isn't a bunch of amateurs. These are some of the highest skilled security researchers and practitioners in the public arena. They are stepping up to meet a need not fulfilled by vendors, namely rapid response to security problems. Why is this the case? Customers running closed operating systems and applications are stuck. They can't fix problems themselves, so they rely on their vendor. In fact, they are paying their vendor to perform the fixing service. To fund development of an alternative fix would be like paying for a fix twice. ZERT is demonstrating that this model is broken. They are trying to respond as fast as possible to attacks. Because no one can be "ahead of the threat," reaction time is often key. ZERT can act faster...

I received a link to this press release today. Unlike many press releases, this one contained interesting news. It reported that a new security company called Exploit Prevention Labs (XPL) just released their first Exploit Prevalence Survey™ , which ranks five client-side exploits used to compromise Web surfers. This seems similar to US-CERT Current Activity , although that report jumbles together many different news items and doesn't name specific exploits. According to the press release The results of the monthly Exploit Prevalence Survey are derived from automated reports by users of Exploit Prevention Labs’ SocketShield anti-exploit software (free trial download at http://www.explabs.com), who have agreed to have their SocketShield installations report all suspected exploit attempts back to the researchers at Exploit Prevention Labs. This reminds me of Microsoft's Strider HoneyMonkey project, which uses bots to crawl the Web looking for malicious sites. XPL inste...

Thanks to Tom Ptacek , I learned of a truly lame SANS poll questioning the responsibility of the Metasploit ie_xp_pfv_metafile component. The poll results as of now show the following: Was the release of the 2nd generation WMF exploit on Dec 31st 2005 irresponsible ? 35 % =>Yes, I 'd like to see the authors brought to justice 21 % =>Yes, they made the world a worse place 32 % =>No, the bad guys had already equal ammunition 11 % =>No, I believe the ends did justify the means Total Answers: 1379 Regarding the first option -- what law exists against writing Metasploit components? About the last -- what "ends" are in play? I would have liked to have seen the following option: "No, I now have a means to test the effectiveness of patches, anti-virus/malware products, and other defensive measures." Without a way to test the effectiveness of countermeasures, defenders are as much at the mercy of the intruders as they are the software vendors who fail t...

I've stayed out of the whole Sony DRM affair because I felt Windows guru Mark Russinovich has forgotten more about Windows internals than I will ever know. I try to avoid commenting on issues out of my league, and Windows rootkits are generally not something I know how to analyze at the host level. However, today I learned of a Wired story that incorporates new Dan Kaminski research. Dan has provided a conservative estimate of the number of systems on which the Sony DRM software is installed, based on Luis Grangeia 's cache snooping methodology. Essentially Dan used his Deluvian Scanning Platform -- DoxPara Infrastructure Validation Project (DIVP) to ask name servers if they had cached results for the hosts associated with Sony's DRM. For example, in the following I query a name server to see if it knows how to resolve www.bejtlich.net. The key is to tell the name server not to perform recursion; if the name server can't answer my request on its own, it has to...

Thanks to a comment from Shahid for pointing me to the WebSense Security Labs presentation The Web Vector: Exploiting Human and Browser Vulnerabilities (.pdf). I think the most interesting part of the briefing is the introduction of Web-based bot net command and control. Because organizations are locking down outbound IRC, bot net controllers are using HTTP as a replacement protocol. If anyone has any experience with this sort of traffic, I would be interested in hearing from you.

As I expected, FrSIRT published an exploit for the Snort Back Orifice vulnerability discovered last week. I was able to compile and execute this code by RD of THC.org on FreeBSD 5.4. orr:/home/richard$ ./THCsnortbo 66.93.110.10 1 Snort BackOrifice PING exploit (version 0.3) by rd@thc.org Selected target: 1 | manual testing gcc with -O0 Sending exploit to 66.93.110.10 Done. orr:/home/richard$ ./THCsnortbo 66.93.110.10 2 Snort BackOrifice PING exploit (version 0.3) by rd@thc.org Selected target: 2 | manual testing gcc with -O2 Sending exploit to 66.93.110.10 Done. Here is what the traffic looks like: 09:30:36.134739 IP 192.168.2.5.56292 > 66.93.110.10.53: 52835 updateD ServFail [5863q][|domain] 0x0000: 4500 0594 0bdb 0000 4011 f669 c0a8 0205 E.......@..i.... 0x0010: 425d 6e0a dbe4 0035 0580 9592 ce63 d1d2 B]n....5.....c.. 0x0020: 16e7 13cf d45a 5a79 4d8a b466 aaa2 c875 .....ZZyM..f...u 0x0030: 2309 78b2 e0d4 ef49 8a8e 39e5 aa8a 4d0d #....

In my first book , the The Tao of Network Security Monitoring: Beyond Intrusion Detection , I say "some intruders are smarter than you," and "intruders are unpredictable." Because of these two facts, prevention eventually fails . In other words, intruders are cleverly figuring out ways to circumvent security of services you have never heard about in ways you could not imagine. As a result, defenses fail and monitoring is the only way to detect that failure and respond appropriately. The story Cross-Site Scripting Worm Hits MySpace is a perfect example of these principles in action. In short, someone figured out how to create a worm on the MySpace online community. More details are posted at this Slashdot thread . I had never heard of MySpace until today, but over a million users were affected by this worm. Did you see this coming? Of course not. There is little point in forecasting future threats. The best we can do is to implement the best preventative ...

Pete has responded to my previous post. Pete says: "I actually believe the REAL threat exists. While everyone else works on the manufactured stuff, I want to protect my assets against true threats. Regardless of my level of confidence, however, I don't claim to have evidence and I refuse to manufacture it. And I find general 'cloak and dagger' statements that security professionals make to be lacking any impact whatsoever... If you really do know and can't say, why would you hang the entire Internet out to dry by keeping in-the-wild exploits against undercover vulnerabilities a secret while you encourage the wheel spinning of research and disclosure?" Many readers in the DC metropolitan area will recognize that I am in a delicate position here. All I can really do is point to some publicly available documents to try to change Pete's world view. He can then make up his own mind. These are all open source, Internet-available documents hosted on complet...

There's a major battle over vulnerability and exploit disclosure occurring between Thomas Ptacek and Pete Lindstrom . I've linked the first post in each side of the debate. I don't know which one should be Godzilla or Mechagodzilla, but I liked the photo at left. I think each side makes some valid points. I agree with Tom that vulnerability disclosure has resulted in elimination of many security problems. I agree with Pete that, in some sense, nothing has really improved, as victims are still being compromised. In the end I would lean more towards Tom; clueful people have a better chance of defending their networks, and at least knowing what is happening if their preventative measures fail. Remember that ten years ago their was no Snort, no Ethereal, no Nessus. Fifteen years ago there was no Argus, and no FreeBSD! Would you believe that Tcpdump is over eighteen years old though? Tom does make an excellent point regarding cryptanalysis : why is it ok to analyze ...

I recently wrote about TippingPoint 's Zero Day Initiative (ZDI), a pay-for-vulnerabilities program. Thank you to the poster (whom I will keep anonymous) for notifying me of this article Vendors Compete for Hacker Zero Days by Kevin Murphy. It features this quote: "[C]ompetitors will have to sign agreements to the effect that they will not irresponsibly disclose the information, and that any data they provide to their own customers cannot be easily reverse engineered into an attack, he [3Com’s David Endler] said. "'Some technology based on Snort would not be eligible because Snort by its nature is open,' Endler said, referring to the open-source IDS software. 'But there are products based on Snort that are closed. We’ll have to take it on a case-by-case basis.'" This means Sourcefire will never be able to learn of ZDI vulnerabilities. Any registered Snort user can download Sourcefire VRT rules and see everything except rules younger than five d...

Through the accursed Slashdot I learned of Tipping Point 's Zero Day Initiative program. (Incidentally, I just figured out that Slashdot is like Saturday Night Live : we all remember it being a lot better years ago, it stinks now, yet we still watch.) According to this CNet story by Joris Evers, which cites TippingPoint's rationale for the program: "'We want to reward and encourage independent security research, promote and ensure responsible disclosure of vulnerabilities and provide 3Com customers with the world's best security protection,' David Endler, director of security research at TippingPoint, said in an interview." This program is similar to the iDEFENSE Vulnerability Contributor Program launched in 2002 amidst much fanfare . This April 2003 interview with iDEFENSE VPC Manager Sunil James is also enlightening. Part of the VCP is a retention reward program that paid a $3,000 bonus to the Danish CIRT and $1,000 to l0rd_yup for vulnerab...

This afternoon I was researching a bot for a chapter in my latest book. I don't spend a lot of time on exploit sites because I am not a penetration tester by trade. I think the last time I really looked at exploits, sites like www.hack.co.za were still around! While searching for the bot in question, I happened to find SecurityForest.com , although the site was announced on BugTraq in March. SecurityForest.com is an impressive piece of work. The site is essentially a giant CVS archive of attack code, called the ExploitTree . They provide a Client Utility, which at least for UNIX, is an interface to a native CVS client. For Windows, they provide everything you need to access a CVS server. Here is how a session using the ExploitTree Client Utility appears under UNIX. ./ExploitTree.pl anonymous ExploitTree Client Utility Manager v0.6 ---------------------------------------- 1) Initialize (first time download) 2) Update Repository 3) Print Exploit Statistics q) Quit > 1 Pass...

When reading today's Incident Handler's Diary , I learned of the public release of draft-gont-tcpm-icmp-attacks-03.txt by the IETF. This Internet Draft explains how forged ICMP messages could be used to conduct denial of service attacks against TCP services. This is the core of the problem: The Host Requirements RFC [4] states that a TCP MUST act on an ICMP error message passed up from the IP layer, directing it to the connection that created the error. In order to allow ICMP messages to be demultiplexed by the receiving host, part of the original packet that elicited the message is included in the payload of the ICMP error message. Thus, the receiving host can use that information to match the ICMP error to the instance of the transport protocol that elicited it. Neither the Host Requirements RFC [4] nor the original TCP specification [1] recommend any security checks on the received ICMP messages. Thus, as long as the ICMP payload contain...

Have you noticed that SecurityFocus has removed exploit code from its vulnerability database ? Anyone knowing why, please email me at richard at taosecurity dot com.