Recent Malware developments

In some of my February's streams :) "The War against botnets and DDoS attacks" and "CME - 24 aka Nyxem, and who's infected?" I covered some of the recent events related to malware trends in the first months of 2006. This is perhaps the perfect time to say a big thanks to everyone who's been expressing ideas, remarks and thoughts on my malware research. While conducting the reseach itself I realized that I simply cannot include everything I want it, as I didn't wanted to release a book to have its content outdated in less than an year, but a "stick to the big picture" representation of the things to come. The best part is that while keeping daily track of the trends and trying to compile a summary to be released at the end of the year, many more concepts that I didn't include come to my mind, so I feel I'll have enough material for a quality summary and justification of my statements. So what are some of the recent developments to keep in mind?

A lot of buzz on the CME-24 front, and I feel quite a lot of time was spent on speculating on the infected population out of a web counter whose results weren't that very accurate as originally though. And as vendors closely cooperated to build awareness on the destructive payload, I think that's the first victory for 2006, no windows of opportunity The best is that CAIDA patiently waited until the buzz is over to actually come up with reliable statistics on Nyxem.

It's rather quiet on the AV radars' from the way I see it, and quickly going through F-Secure's, Kaspersky's (seem to be busy analyzing code, great real-time stats!), Symantec's I came across the similarities you can feel for yourself in "the wild" :) Symantec's ThreatCon is normal, what's interesting to note is VirusTotal's flood of detected WMF's, which is perhaps a consequence of the *known* second vulnerability.

James Ancheta's case was perhaps the first known and so nicely documented on botnet power on demand. Recently, a botnet, or the participation in such shut down a hospital's network, more over I think StormPay didn't comply with a DDoS extortion attempt during the weekend?

Joanna Rutkowska provided more insights on stealth malware in her research (slides, demo) about "about new generation of stealth malware, so called Stealth by Design (SbD) malware, which doesn't use any of the classic rootkit technology tricks, but still offers full stealth. The presentation also focuses on limitations of the current anti-rootkit technology and why it’s not useful in fighting SbD malware. Consequently, alternative method for compromise detection is advocated in this presentation, Explicit Compromise Detection (ECD), as well as the challenges which Independent Software Vendors encounter when trying to implement ECD for Windows systems – I call it Memory Reading Problem (MRP). "

How sound is the possibility of malware heading towards the BIOS anyway? An "Intelligent P2P worm's activity" that I just across to also deserves to be mentioned, the concept is great, still the authors have to figure out how to come up with legitimate file sizes for multimedia files if they really want to fake its existence, what do you think on this?

Some recent research and articles worth mentioning are, Kaspersky's Malware - Evolution : October - December 2005 outlines the possibilities for cryptoviral extortion attacks, 0days vulnerabilities, and how the WMF bug got purchased/sold for $4000. There's also been quite a lot of new trojans analyzed by third-party researchers, and among the many recent articles that made me an impression are "Malicious Malware: attacking the attackers, part 1" and part 2, from the article :

"This article explores measures to attack those malicious attackers who seek to harm our legitimate systems. The proactive use of exploits and bot networks that fight other bot networks, along with social engineering and attacker techniques are all discussed in an ethical manner."

Internet worms and IPv6 has nice points, still I wish there were only network based worms to bother about. Besides all I've missed important concepts in various commentaries, did you? Malware is still vulnerabilities/social engineering attacks split at least for the last several months, still the increased corporate and home IM usage will inevitable lead to many more security threats to worry about. Web platform worms such as MySpace and Google's AdSense Trojan, are slowly gaining grounds as a Web 2.0 concept, so virus or IDS signatures are to look for, try both!

During January, David Aitel reopened the subject of beneficial worms out of Vesselin Bontchev's research on "good worms". While I have my reservations on such a concept that would have to do with patching mostly the way I see it, could exploiting a vulnerability in a piece of malware by considered useful some day, or could a network mapping worm launched in the wild act as an early response system on mapped targets that could end up in a malware's "hitlist"? And I also think the alternative to such an approach going beyond the network level is Johnny Long's (recent chat with him) Google Dorks Hacking Database, you won't need to try to map the unlimited IPv6 address space looking for preys. Someone will either do the job for you, or with the time, transparancy in IPv6, one necessary for segmented and targeted attacks will be achieved as well.

Several days ago, Kaspersky released their summary for 2005, nothing ground breaking in here compared to previous research on how the WMF vulnerability was purchased/sold for $4000 :) but still, it's a very comprehensive and in-depth summary of 2005 in respect to the variables of a malware they keep track of. I recommend you to go through it. What made me an impression? 

- on average, 6368 malicious programs detected by month

- +272% Trojan-Downloaders 2005 vs 2004

- +212% Trojan-Dropper 2005 vs 2004

- +413% Rootkit 2005 vs 2004

- During 2005, on average 28 new rootkits a month

- IM worms 32 modifications per month

- IRC worms are on -31%

- P2P worms are on -43%, the best thing is that Kaspersky labs also shares my opinion on the reason for the decline, P2P busts and general prosecutions for file-sharing. What's also interesting is to mention is the recent ruling in a district court in Paris on the "legality of P2P" in France and the charge of 5 EUR per month for access to P2P, but for how long? :) P2P filesharing isn't illegal and if you cannot come up with a way to release your multimedia content online, don't bother doing at all. In previous chats I had with Eric Goldman, he also makes some very good points on the topic.

- +68% Exploit, that is software vulnerabilities and the use of exploits both known or 0day's with the idea to easily exploit targeted PC, though I'm expecting the actual percentage to be much higher

- Internet banking malware reached a record 402% growth rate by the end of 2005 The Trojan.Passwd is a very good example, it clearly indicates that it is written for financial gains. E-banking can indeed prove dangerous sometimes, and while I'm not being a paranoid in here, I'd would recommend you go through Candid's well written "Threats to Consider when doing E-banking" paper

- A modest growth from 22 programs per month in 2004 to 31 in 2005 on the Linux malware front

I feel today's malware scene is so vibrant that it's getting more and more complex to keep track of possible propagation vectors, ecosystem here and there, and mostly communicating what's going on to the general public(actually this one isn't). 

What's to come and what drives the current growth of malware?
- money!
- the commercialization of the market for software vulnerabilities, where we have the first underground purchase of the WMF exploit, so have software vulnerabilities always been the currency of trade in the security world or they've started getting the necessary attention recently?
- is stealth malware more than an issue compared to utilizing 0day vulnerabilities, and is retaining current zombie PCs a bigger priority than to infecting new ones?
- business competitors, enemies, unethical individuals are actively seeking for undetected pieces of malware coded especially for their needs, these definitely go beneath the sensors
- Ancheta's case is a clear indication of a working Ecosystem from my point of view, that goes as high as to provide after-sale services such as DDoS strength consultations and 0day malware on demand

To sum up, malware tends to look so sneaky when spreading and zoomed out :) I originally came across the VisualComplexity project in one of my previous posts on visualization. Feel I've missed something that's worth mentioning during the last two months? Than consider expanding the discussion!

You can also consider going through the following resources related to malware :

Semantics-Aware Malware Detection

Enabling Worm and Malware Investigation Using Virtualization

Botnet Detection and Response - The Network is the Infection
Fileprint analysis for Malware Detection

Back to the Future: A Framework for Automatic Malware Removal and System Repair

Assessing your Malware Exposure with Snort

Truman - The Reusable Unknown Malware Analysis Net

The Malcode Analyst Pack

Nepenthes - malware collecting and visualizing tool

Browser Appliance Virtual Machine

Mwcollect - a distributed malware collector network

Technorati tags:
security, information security, malware, antivirus, botnets, kaspersky

Continue reading →

Who needs nuclear weapons anymore?

Excluding Iran and the potential of its nuclear program (no country that bans music should have such a power!), perhaps I should rephrase - who can actually use them nowadays, are they just a statement of power, does flexibility and beneath the radar concepts matter? I feel they do.

I just came across a news article from January on a new EMP warhead test, and while there have been speculations/or movie plots that Electromagnetic Pulse Weapons could be used by terrorists, I find this a bit of exaggerated statement that actually seeks further investment in current development of the concept I guess. I feel that compared to symmetric warfare, asymmetric warfare as a concept has greatly evolved during the years, and in today's interconnected society, military powers could be easily balanced. What's else to mention is the "cooperation" between the parties on which I came across in a report on Nuclear Electromagnetic Pulse, as of June 9, 2005, namely :

"If we really wanted to hurt you with no fear of retaliation, we would launch an SLBM,'' which if it was launched in a submarine at sea, we really would not know for certain where it came from. ``We would launch an SLBM, we would detonate a nuclear weapon high above your country, and we would shut down your power grid and your communications for 6 months or so.'' The third-ranking communist was there in the country. His name is Alexander Shurbanov, and he smiled and said, ``And if one weapon would not do it, we have some spares.'' I think the number of those spares now is something like 6,000 weapons." 

"the Russians had developed weapons that produced 200 kilovolts per meter. Remember, the effects in Hawaii were judged to be the result of five kilovolts per meter. So this is a force about 200 times higher. The Russian generals said that they believed that to be several times higher than the hardening that we had provided for our military platforms that they could resist EMP."

``Chinese military writings described EMP as the key to victory and described scenarios where EMP is used against U.S. aircraft carriers in the conflict over Taiwan.'' So it is not like our potential enemies do not know that this exists. The Soviets had very wide experience with this, and there is a lot of information in the public domain relative to this. ``A survey of worldwide military and scientific literature sponsored by the commission,'' that is the commission that wrote this report, ``found widespread knowledge about EMP and its potential military utility including in Taiwan, Israel, Egypt, India, Pakistan, Iran, and North Korea."

Still there's hope for preserving the global state of security instead of fuelling its insecurity :

"In 2004, the EMP Commission met with very senior Russian officers, and we showed that on the sign. They warned that the knowledge and technology to develop what they called super EMP weapons had been transferred to North Korea and that North Korea could probably develop these weapons in the near future, within a few years. The Russian officers said that the threat that would be posed to global security by a North Korean armed with super EMP weapons was, in their view, and I am sure, Mr. Speaker, in your view and mine, unacceptable."  

Foreign views of Electromagnetic Pulse (EMP) Attack reveals further details on other nations' ambitions etc. Perhaps one of the most famous commitments towards EMP is the The Trestle Electromagnetic Pulse Simulator that can also be seen at Google Maps, still, in my opinion it's a defensive initiative for an offensive purpose :(

Extending the topic even further, The Space Warfare arms race has been an active policy of key world's leaders for decades, and that's not good. The U.S, Russia and China as the main players are fuelling the growth in one way or other due to believing in perhaps :

- that the other sides are actively developing such capabilities, and they are, because they think the opposite => arms race
- growing trend towards asymmetric warfare
- cost-effectiveness compared to building a multimillion nuclear submarine as a statement of power?

In my opinion space warfare would directly influence everyone down here on Earth, and scenarios such as :

- satellites jamming

- space SIGING

- hijacking?

- destroying

could become normal. Space is already getting crowded, if I were to forget one of my favourite quotes "But I guess I'd say if it is just us... seems like an awful waste of space". On the other, and in respect to securing critical infrastructure on Earth :) I find recent initiatives such as the Cyber Storm exercise more PR, than relevance oriented, my point is that how come you expect to have the critical infrastructure secured, when a global overload in traffic would again deny service, a critical one. 

My point is that, the Internet as the most pervasive and cost effective tool is often utilized for sensitive both, commercial, government and military operations, attacking the Internet affects pretty much everyone. Excluding the overall shift towards network-centric warfare and you've got a problem given commercial and public IP networks are used to handle the enormous bandwidth needed for sensitive operations.

To sum up, go through the following War Quotes, and perhaps consider how major problems on Earth stop major innovations in Space. I feel War is not a solution, but an excuse that should never be said! I know this post tried to combine several different issues, but I think given IP is at the bottom line, my readers wouldn't mind :) What's your attitude on Space Warfare arms race? Is it real, and how do you picture the future developments in here?

More resources on Electromagnetic Pulse Weapons, Space Warfare and Network-Centric Warfare are also available at :

High Altitude Electromagnetic Pulse (HEMP) and High Power Microwave (HPM) Devices: Threat Assessments

The Effects Nuclear Weapons

ELECTROMAGNETIC PULSE -- (House of Representatives - June 21, 2005)

Preliminary Findings of the Commission to Assess the Threat from EMP

Communications Electronic Warfare and the Digitised Battlefield

The Implementation of Network-Centric Warfare

Complexity Theory and Network Centric Warfare

On Space Warfare

Warfare in Space

Space Systems Survivability

Developments in Military Space: Movement toward space weapons?

Weapons in Space: Silver Bullet or Russian Roulette?

From Cold War to Asymmetric Warfare

Four Myths about Space Power

China as a Military Space Competitor

Continue reading →

The War against botnets and DDoS attacks

In one of my previous posts talking about botnet herders I pointed out how experiments tend to dominate, and while botnets protection is still a buzz word, major security vendors are actively working on product line extensions. DDoS attacks are the result of successful botnet, and so are the root of the problem besides the distributed concept. Techworld is reporting that McAfee is launching a "bot-killing system", from the article :

"Unlike conventional DDoS detection systems based on the statistical analysis of traffic, the first layer of the new Advanced Botnet Protection (ABP) intrusion prevention system (IPS) uses a proxy to pass or block packet traffic dependent on whether or not it is “complete”. "

The best thing is that it's free, the bad thing is that it may give their customers a "false sense of security", that is, while the company is actively working on retaining its current customers, I feel "SYN cookies" and their concept has been around for years. Moreover, using a service provided by a company whose core competencies have nothing to do with DDoS defense can be tricky. Companies worth mentioning are Arbor Networks, and Cisco's solutions, besides the many other alternative and flexible ways of dealing with DDoS attacks.

In my research research on the Future trends of Malware, I pointed out some of the trends related to botnets and DDoS attacks, namely, DDoS extortion, DDoS on demand/hire, and with the first legally prosecuted case of offering botnet access on demand, it's a clear indication that of where things are going. Defense against frontal attacks isn't cost-effective given that at the bottom line the costs to maintain the site outpace the revenues generated for the time, hard dollars disappear, soft ones as reputation remain the same.

My advice is to take into consideration the possibility to outsource your problem, and stay away from product line extensions, and I think it's that very simple. A differentiated service on fighting infected nodes is being offered by Sophos, namely the Zombie Alert, which makes me wonder why the majority of AV vendors besides them haven't come up with an alternative given the data their sensor networks are able to collect? Moreover, should such as service be free, would it end up as a licensed extensions to be included within the majority of security solutions, and can a motivated system administrators successfully detect, block, and isolate zombie traffic going out of the network(I think yes!)? 

As far as botnets are concerned, there were even speculations on using "Skype to control botnets", now who would want to do that, and under what reason given the current approaches for controlling botnets, isn't the use of cryptography or security through obscurity("talkative bots", stripping IRCds) the logical "evolution" in here?

Something else worth mentioning is the trend of how DoS attacks got totally replaced by DDoS ones, my point is that the first can be a much more sneaky one and easily go beneath the radar, compared to a large scale DDoS attack. A single packet can be worth more than an entire botnets population, isn't it?

How do you think DDoS attacks should be prevented, active defense such as the solutions mentioned, or proactive solutions? What do you think?

You can also go though other resources dealing with DDoS attacks and possible solutions to the problem :

Dave Dittrich's DDoS attacks and protection page

Recommendations for the Protection against Distributed Denial-of-Service Attacks in the Internet

Botz-4-Sale: Surviving Organized DDoS Attacks That Mimic Flash Crowds

Defense Against DoS/DDoS Attacks

DDoS: Undeniably a global Internet problem looking for a global solution

Scalable Protecting Against DDoS and Worm Attacks

An Analysis of Using Reflectors An Analysis of Using Reflectors

Attacking DDoS at the Source

A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms

A Survey of DDoS Defense Mechanisms

A summary of DoS/DDoS prevention, Monitoring and Mitigation Techniques in a Service Provider Environment

Experience in fighting DDoS attacks

Distributed Defense Against DDoS Attacks

On the Effectiveness of DDoS Attacks on Statistical Filtering

The Spamhaus Don't Route or Peer List (DROP)

The Prolexic Zombie Report

Technorati tags :

security, information security, malware, botnets, DDoS, McAfee, Sophos, AntiVirus Continue reading →

A top level espionage case in Greece

Starting shortly after the Olympic games in 2004 and up to March 2005, the mobile phones of : Prime Minister Costas Caramanlis, minister of foreign affairs, defense, public order and justice, top military officials, a number of journalists, and human rights activists (hmm?) have been tapped by an unknown party though the installation of "spy software" (that's too open topic) , mind you, Vodafone's central system, and were diverted to a pay-as-you-go mobile phone.

At the bottom line, who's behind it? Interested parties within the Greek government, or external ones? To me this is the job of a dead insider's job or someone who had the incentive to Vodafone's security, which I doubt. Though, it is disturbing how easily these mobile numbers could be obtained as the majority of media representitives already have them! My point is that you should count them as the weakest link, besides accessing a mobile provider's database and other sources. UPDATE : Vodafone's statement UPDATE 2 : Cryptome featured more info on the The Greek illegal wiretapping scandal: some translations and resources.

Another recent spy case was the rock transmitter found in a Moscow park and while the Russian president Putin is cheering the discovery and keeping it diplomatic, the FSB (a successor to the KGB) is taking a note on this one. You can actually go through a collection of videos and references on the case.

I guess it's the silence that's most disturbing in the "Silent War".

Technorati tags :

security, information security, espionage, Intelligence, Greece, Insider

Continue reading →

Security Awareness Posters

Security is all about awareness at the bottom line. The better you understand it, the higher your chance of "survival", and hopefully progress!
 

Enjoy the following collections of witty and amusing security awareness posters :

1, 2, 3 (you may also be interested in going through my talk on security policies and awareness with K Rudolph from Native Intelligence as well), 4, 5, 6, 7, 8.

Technorati tags:

security, information security, security training, security education Continue reading →

Hacktivism tensions

It was about time the freedom of the press and the democratic nature of joking with politicians takes its hit. But why with spiritual leaders? The contradictive Muhammad cartoons sparkled a lot of anger, and with the recent tentions in France all we needed was a hacktivism activity from angry muslims. Remember how the China vs U.S cyberwar was sparkled due to the death of a Chinese pilot crashing into an AWACS that was sort of "keeping it quiet"?

Zone-H is reporting on massive defacements of Danish sites, and if you take the time to go through the reported reasons you'll find out that :

"political reasons"

"just for fun"

"I just want to be the best defacer"

"revenge against that web site"

"patriotism"

tend to dominate. As far as defacements as concerned, in one of my previous posts "FBI's 2005 Computer Crime Survey - what's to consider?" you can see that according to the report, organizations lost approximately $10,395M due to web site defacements. Moreover, in some of my previous research on Cyberterrorism I've indicated the use of script kiddies for PSYOPS and how such defacements have a favorable psychologic effect on future initiatives.

And while they have the motivation to deface, I wonder would someone strike back and under what justification?

Technorati tags:

security, information security, defacement, Zone-H, hacktivism, cyberterrorism, Muhammad cartoons, hacking, Denmark Continue reading →

The current state of IP spoofing

A week ago, I came across a great and distributed initiative to map the distribution of spoofable clients and networks - the ANA Spoofer Project, whose modest sample of 1100 clients, 500 networks and 450 ASes can still be used to make informed judgements on the overall state of IP Spoofing. I once posted some thoughts on "How to secure the Internet" where I was basically trying to emphasize on the fact that securing critical infrastructure by evaluating how hardened to attacks it really is, can be greatly improved as a concept. What if that infrastructure is secured, but the majority of Internet communications remain in plain-text, and are easily spoofable, which I find as one of the biggest current weaknesses. If you can spoof there's no accountability, and you can even get DDoSed by gary7.nsa.gov, isn't it? (in the original Star Trek series, Gary Seven was the covert operative who returned from the future to fix sabotage to the United States' first manned rocket to the moon moments before lift off).

On the other hand, according to Gartner IPSec will be dead by 2008, but I feel this is where its peak and maturity would actually be reached. IPv4 will evolve to IPv6, therefore IPSec will hopefully be an inseparable of the Internet.

So what's the bottom line so far?

- 366 million spoofable IP addresses out of 1.78 billion
- 43,430 spoofable netblocks
- 4700 spoofable ASes out of 18450
- NAT's and XP SP2's make their impact

The higher the population the scarier the numbers for sure! I have always believed in distributed computing and the power of the collective intelligence of thousands of people out there. Be it integrating powerful features whose results are freely available to the public through OEM agreements or whatsoever, I feel in the future more vendors will start taking advantage of their customers' base for

How you can contribute? Pick up your client, start spoofing, but make sure your actions don't raise someone's eyebrows, even though you simply wanted to contribute, that's just a couple of packets to a university's server that's looking forward to receiving them this time :)

Dshield.org - the Distributed Intrusion Detection System is a very handy and useful OSINT tool that is obviously being used by the NSA as well (check out the Internet Storm Center's post on this, and the photo itself) UPDATE : Cryptome also featured fancy pictures from the NSA's Threat Operations Wizardy.

What is your opinion on the current state of IP Spoofing on the web and the fact how handy this insecurity comes to DDoS attacks? What should be done from your point of view to tackle the problem on a large scale?

You can also consider going through many other distributed concepts :

The original DES Cracker Project
DJohn - Distributed John
Bob the Butcher distributed password cracker
Seti at Home
ForNet : A Distributed Forensics Network
Pandora - Distributed Multirole Monitoring System
FLoP - distributed Snort sensor
DNSA - DNS auditing tool
Despoof - anti packet spoofing

As well as read more info on IP Spoofing, Distributed concepts and related tools :

IP Spoofing - An Introduction
Distributed Tracing of Intruders
Distributed Phishing Attacks
MAC Distributed Security
IPv6 Distributed Security(draft)
Distributed Firewalls
Web Spoofing
The threats of distributed cracking

Technorati tags:

security, information security, spoofing, IPSec, IPv6, distributed

Continue reading →

What search engines know, or may find out about us?

Today, CNET's staff did an outstanding job of finding out what major search companies retain about their users. AOL, Google, Microsoft and Yahoo! respond on very well researched questions!

Whatever you do, just don't sacrifice innovation and trust in the current services for misjudged requests at the first place from my point of view.

At the bottom line, differentiate your Private Searches Versus Personally Identifiable Searches, consider visiting Root.net, and control your Clickstream. You can also go through Eric Goldman's comments on the issue and his open letter regarding Search Engines and China.

As a matter of fact, I have just came across a very disturbing fact that I compare with initiatives to mine blogs for marketing research, EPIC has the details on its front page. It was about time a private entity comes up with the idea given the potential and usability of the idea. Could such a concept spot, or actually seek for cyber dissidents in restrictive regimes with the idea to actually reach them, besides mining for extremists' data? I really hope so!

Technorati tags:  

Privacy, search engine, Google, Yahoo, MSN, AOL

Continue reading →

CME - 24 aka Nyxem, and who's infected?

Today, the F-Secure's team released a neat world map with the Nyxem.E infections. As you can see the U.S and Europe have been most successfully targeted, but I wonder would it be the same given the author started localizing the subject/body messages found within the worm to other languages? Who seeks to cause damage instead of controlling information and network assets these days? A pissed off commodities trader? :) or on request, as the original version of the worm "can perform a Denial of Service (DoS) attack on the New York Mercantile Exchange website (www.nymex.com)", still that's 2 years ago.

Tomorrow is the day when the worm should originally start deleting all all *.doc, *.xls, *.mdb, *.mde, *.ppt, *.pps, *.zip, *.rar, *.pdf, *.psd and *.dmp on an infected PC's, supposedly network drives as well, what I also expect is more devastation on the 3rd of March given the same happens every month. And while I doubt there's still someone out there unaware of this, perhaps, released under "revenge mode" malware, check out Internet Storm Center's summary, and know know your enemy, hopefully not until next month again! UPDATE : You can actually go through another post in order to update yourself with some recent malware developments.

Technorati tags : malware, Nyxem

Continue reading →

Suri Pluma - a satellite image processing tool and visualizer

I just came across a great satellite image processing software and decided to share it with my blog readers. Perhaps that's a good moment to spread the word about my RSS compatible feed, so consider syndicating it. To sum up :

"Suri Pluma is a satellite image processing tool and visualizer. It can open the most common image formats without importing to an internal format and minimizing the memory required for visualization. It is designed to be modular and extensible. It has a meassurement tool (distance and areas with error estimation) and geographical and map coordinate information."

Check out the screenshots and consider downloading it in case you're interested. Meanwhile, you can also go through a previous post that's again related to visualization.

Technorati tags : 

satellites, visualization, Suri Pluma

Continue reading →

January's Security Streams

It's been quite a busy month, still I've managed to keep my blog up to date with over 30 posts during January, here they are with short summaries. Thanks for the comments folks!

I often get the question, how many people is my blog attracting, the answer is quantity doesn't matter, but the quality of the visits, still, for January there were 7,562 unique visits and over 13,000 pageloads. I'm already counting over 400 .mil sub domains, have the majority of security/AV vendors(hi!) reading it, and the best is how long they spend on average, and how often they come back. To sum up, 60% of all visits come from direct bookmark of my blog, 30% through referers, and 10% from search engines. It is also worth mentioning my last referring link, notice the domain and what they are interested in.

1. What's the potential of the IM security market? Symantec thinks big" gives a brief overview of the wise acquisition Symantec did and a little something the IM security market.

2. "Keep your friends close, your intelligence buddies closer!" mentioning the release of a book excerpt and provides further resources on various NSA and intelligence related topics

3. "Security quotes : a FSB (successor to the KGB) analyst on Google Earth" is Google Earth or satellite imagery a national security threat? At least the Russian FSB thinks so!

4. "How to secure the Internet" discusses the U.S National Strategy to Secure Cyberspace and some thoughts on the topic

5. "Malware - Future Trends" the original announcement for the release of my research

6. "Watch out your Wallets!" gives more info on ID theft and talks about a case that left a 22 years old student in debt of $412,000

7. "Would we ever witness the end of plain text communications?" a released report on the growth of VPNs prompted me to open up the topic, recently, Yahoo! communicate over SSL by default which is a great progress from my point of view

8. "Why we cannot measure the real cost of cybercrime?" an in-depth summary of my thoughts on why we cannot measure the real cost of cybercrime, and why I doubt the costs outpace those due to drug smuggling

9. "The never-ending "cookie debate" tries to emphasize on how the Cookie Monster should worry about cookies only, and what else to keep in mind concerning further techniques that somehow invade your privacy

10. "The hidden internet economy" here I argue on what would the total E-commerce revenues be given those afraid to purchase over the Internet actually start doing it.

11. "Security threats to consider when doing E-Banking" provides a link to practical research conducted by a dude I happen to know :)

12. "Insecure Irony" is indeed an ironical event, namely how a private enterprise, one used to gather intelligence actually lost sensitive info belonging to the Intelligence Community

13. "Future Trends of Malware" the post mentioning my Slashdotted research and the rest of the people and respected sites that recognized it

14. "To report, or not to report?" how can you measure costs when the majority of companies aren't even reporting the breaches, cannot define a breach, or think certain breaches don't require law enforcement intervention?

15. "Anonymity or Privacy on the Internet?" argues on what exactly different individuals are trying to achieve, is it Anonymity, is it Privacy and provides further resources on the topic

16. "What are botnet herds up to?" gives a brief overview of recent botnet herds' activities the ways used to increase the revenues through affiliate networks, or domaining. It also provides good resources on the topic of Bots and Botnets

17. "China - the biggest black spot on the Internet’s map" a very recent and resourceful overview of Internet Censorship in China, that also provides further resources on the topic

18. "FBI's 2005 Computer Crime Survey - what's to consider?" one day after the release of the FBI's survey I summarized the key points to keep in mind

19. "Why relying on virus signatures simply doesn't work anymore?" a very practical post that argues and tries to build more awareness on how the number of signatures detected by a vendor doesn't actually matter, still there are other solutions that will get more attention with the time. I received a lot of feedback on this, both vendors and from folks I met through my blog, thanks for the ideas!!

20. "2006 = 1984?" gives more details on private sector companies innovating in the wrong field, and further resources on censorship and surveillance practices

21. "Cyberterrorism - recent developments" an extended overview of Cyberterrorism, and a lot of facts worth mentioning obtained through a recently released report on the topic

22. "Still worry about your search history and BigBrother?" Some humor, be it even a black one is always useful

23. "Homebrew Hacking, bring your Nintendo DS!" Homebrew hacking is slowly emerging and I see a lot of potential in the "do it yourself culture"

24. "Visualization, Intelligence and the Starlight project" a post worth checkin' out, it provides an overview of various visualization technologies and talks about the Starlight project

25. "The Feds, Google, MSN's reaction, and how you got "bigbrothered"?" I'm not coining new terms here, "bigbrothered" is slowly starting to be used be pretty much everyone, yet I try to give practical tips on why the whole idea was wrong from the very beginning, and how other distribution vectors should also be considered

26. "Personal Data Security Breaches - 2000/2005" I came across a great report summarizing the issue, and tried to highlight the cases worth mentioning, some are funny, others are unacceptable

27. "Skype to control botnets?!" good someone is brainstoring, but that's rather unpractical compared to common sense approaches botnet herders currently use

28. "Security Interviews 2004/2005 - Part 1" Grab a beer and start going through this great contribution, soon to appear at Astalavista itself!

29. "Security Interviews 2004/2005 - Part 2" Part 2

30. "Security Interviews 2004/2005 - Part 3" and Part 3

31. "Twisted Reality" Everything is not always as it seems, and it's Google I have in mind :(

32. "How we all get 0wn3d by Nature at the bottom line?" :)

33. "Was the WMF vulnerability purchased/sold for $4000?!" among the few vendors I actually trust released a nice summary no one seems to be taking into consideration, still I find it truly realistic given the potential of the 0day market for software vulnerabilities

Till next month, and thanks to all readers for taking their time to go through my research and contributions!

Technorati tags :
security, information security

Continue reading →

Was the WMF vulnerability purchased for $4000?!

Going through Kaspersky's latest summary of Malware - Evolution, October - December 2005, I came across a research finding that would definitely go under the news radar, as always, and while The Hackers seem to be more elite than the folks that actually found the vulnerability I think the issue itself deserves more attention related to the future development of a market for 0day vulnerabilities.

Concerning the WMF vulnerability, it states :

"It seems most likely that the vulnerability was detected by an unnamed person around 1st December 2005, give or take a few days. It took a few days for the exploit enabling random code to be executed on the victim machine to be developed. Around the middle of December, this exploit could be bought from a number of specialized sites. It seems that two or three competing hacker groups from Russian were selling this exploit for $4,000. Interestingly, the groups don't seem to have understood the exact nature of the vulnerability. One of the purchasers of the exploit is involved in the criminal adware/ spyware business, and it seems likely that this was how the exploit became public."

Two months ago, I had a chat with David Endler, director of Security Research at TippingPoint, and their ZeroDayInitiative, that is an alternative to iDefense's efforts to provide money as a incentive for quality vulnerabilities submissions. The fact that a week or so later, the first vulnerability appeared on Ebay felt "good" mainly because what I was long envisioning actually happened - motivated by the already offered financial rewards, a researcher decided to get higher publicity, thus better bids. I never stopped thinking on who gains, or who should actually gain, the vendor, the end user, the Internet as a whole, or I'm just being a moralist in here as always?

This very whole concept seemed flawed from the very beginning to me, and while you wish you could permanently employ every great researcher you ever came across to, on demand HR and where necessary seems to work just fine. But starting with money as an incentive is a moral game where "better propositions" under different situations could also be taken into consideration. Researchers will always have what to report, and once ego, reputation and publicity are by default, it comes to the bottom line - the hard cash, not "who'll pay more for my research?", but "who values my research most of everyone else?". And when it comes to money, I feel it's quite common sense to conclude that the underground, have plenty of it. I am not saying that a respected researcher will sell his/her research to a illegal party, but the a company's most serious competitors are not its current, but the emerging ones, I feel quite a lot of not so publicly known folks have a lot to contribute..

Possible scenarios on future vulnerability purchasing trends might be :

- what if vendors start offering rewards ($ at the bottom line) for responsibly reported vulnerabilities to eliminate the need of intermediaries at all, and are the current intermediaries doing an important role of centralizing such purchases? I think the Full Disclosure movement, both conscious or subconscious :) is rather active, and would continue to be. Now, what if Microsoft breaks the rules and opens up its deep pocketed coat?

- how is the 0day status of a purchased vulnerability measured today? My point is, what if the WMF vulnerability was used to "nail down" targeted corporate customers, or even the British government as it actually happened , and this went totally unnoticed due to the lack of mass outbreaks, but the author sort of cashed twice, by selling the though to be 0day to iDefense, or ZeroDay's Initiative? What if?

- requested vulnerabilities are the worst case scenario I could think of at the moment. Why bother and always get excited about an IE vulnerability, when you know person/company X are running Y AV scanner, use X1 browser as a security through obscurity measure. That's sort of reverse model compared to current one where researchers "push" their findings, what if it turns into a "pull" approach, "I am interested in purchasing vulnerabilities affecting that version of that software", would this become common, and how realistic is it at the bottom line?

Some buddies often ask me, why do I always brainstorm on the worst case scenario? I don't actually, but try to brainstorm on the key factors and how the current situation would inevitably influence the future. And while I'm not Forrester Research, I don't charge hefty sums for 10 pages report on the threats posed by two-factor authentication or e-banking, do I? Still, I'm right on quite some occasions..

At the bottom line, ensure $ isn't the only incentive a researcher is getting, and don't treat them like they are all the same, because they aren't, instead sense what matters mostly to the individual and go beyond the financial incentive, or you'll lose in the long term.

What are you thoughts on purchasing vulnerabilities as far as the long term is concerned? What is the most effective compared to the current approaches way of dealing with 0day vulnerabilities? Might a researcher sell his findings to the underground given he knows where to do it? What do you think?

UPDATE : "Where's my 0day, please?"

Technorati tags :
security, information security, vulnerabilities, underground, 0day vulnerability market, WMF, Kaspersky, malware

Continue reading →

How we all get 0wn3d by Nature at the bottom line?

I just came across a clip courtesy of NASA that can be described as a beautiful devastation, still it reminds me of how insecure we are at the bottom line. And no, I don't see how you will distribute a signature for this, or can you? :)

Technorati tags :
katrina, security

Continue reading →

Twisted Reality

I looked up the definition of Evil today, and I found it, I tried to play a Google War and came across 256 million occurrences of it, still there's a hope for all of us I guess. On the 17th of January I blogged on how China turned into the biggest black spot on the Internet's map, to find out that I even have activists commenting in my blog :)

Google has agreed to "remove certain sensitive information from our search results" you all know it by now, what you perhaps don't know is how what used to be the old Google still has its marks on the web. Google's Information for Webmasters still states that :

"Google views the comprehensiveness of our search results as an extremely important priority. We're committed to providing thorough and unbiased search results for our users."

I guess Chinese users should print this and stick it on their walls to remind them of the past as it says exactly the same. They have also removed their "censored notice" from "older removals", how come, and for what reason? Lack of accountability for when "local laws, regulations, or policies" were removing "sensitive information" before the date?! Google is my benchmark for disruption, but I guess its actions and "do no evil" motto were simply too pure for the business world, which on the majority of occasions is capable of destroying morale, even individuals..

Welcome in a "Twisted Reality" where one event looks like an entirely different one - on request, and the list is getting bigger!

But what is actually filtered in china these days, what are the topics of interest? Four years ago, a great initiative brough more insights into what's deemed "sensitive information", and while of course the list is changed on-the-fly, it is important to know how it blocks the top results, as this is where all the traffic goes.

Recently, CNET did a nice research on which sites are blocked by which search engine, I ever saw Neworder in there :)

The best thing about China's backbone is how centralized it really is and the way researchers are finding common censorship patters that could prove useful for future research. Is TOR with its potential applicable in China, and would initiatives such as the the Anonymous OS, or even TorPark, an USB extension of the idea, the future?

Meanwhile, in case they are interested parties reading this post, consider taking a look at the "Handbook for Bloggers and Cyber-Dissidents" courtesy of Reporters Without Borders.

Technorati tags :
privacy, censorship, search engine, google, china, TOR, Anonymity

Continue reading →

Security Interviews 2004/2005 - Part 2

Part 2 includes :

11. Eric (SnakeByte) – http://www.snake-basket.de/ - 2005
12. Björn Andreasson – http://www.warindustries.com/ - 2005
13. Bruce - http://www.dallascon.com/ - 2005
14. Nikolay Nedyalkov - http://www.iseca.org/ - 2005
15. Roman Polesek - http://www.hakin9.org/en/ - 2005
16. John Young - http://www.cryptome.org/ - 2005

Go through Part 1 and Part 3 as well!

Part of Asta's Security Newsletter---------------------------
Interview with SnakeByte (Eric), http://www.snake-basket.de/

Astalavista : Hi Eric, would you please introduce yourself to our readers and share your experience in the security scene?

Eric : I am 24 years old, currently studying computer science in Darmstadt, Germany for quite some time now. I am mostly a lazy guy, doing whatever I am currently interested in. My interest in computer security started with viruses ( no, I never spreaded one ), which were really interesting back then, but nowadays every worm looks the same;(

Astalavista : Things have changed much since the days of Webfringe, Progenic, BlackCode etc. What do you think are the main threats to security these days? Is it our dependece on technologies and the Internet the fact that it's insecure by design or you might have something else in mind?

Eric : I think security itself got a lot better since then but we have more dumb users who work hard to make it worse now. Most users nowadays get flooded with viruses and just click them,
also the recent rise in phishing attacks - it's not the box which gets attacked here, it's the user. Security also got a lot more commercial.

Astalavista : What is your opinion on today's malware and virii scene? Do you think that groups such as the infamous A29 have been gaining too much publicity? What do you think motivates virii writers and virii groups now in comparison to a couple of years ago?

Eric : It's 29a :) And they deserve the publicity they got. They did and are doing some really cool stuff. But they also were clever enough to be responsible with the stuff they created. About motivation for virii writers - it's different for each of them, have to ask them.

But I think there is a new motivation - money. Nowadays you can get paid for a couple of infected computers, so spammers can abuse them.

Astalavista : What do you think of Symantec ? Is too much purchasing power under one roof going to end up badly, or eventually the whole industry is going to benefit from their actions?

Eric : Sure monopolies are always bad but we get them everywhere nowadays. Maybe we need another revolution...

Astalavista : Is the practice of employing teen virii writers possessing what is thought to be a "know-how" a wise idea? Or it just promotes lack of law enforcement and creates ordes of source modifying or real malware coders?

Eric : I dont think it is a wise idea at all, but don't tell my boss ;-) Whether one has written virii or not should not influence your decision to you hire him/her.

Astalavista : Application security has gained much attention lately. Since you have significant programming experience, what do you think would be the trends in this field over the next couple of years, would software be indeed coded more securely?

Eric : Maybe,if universities started to teach coding in a secure way instead of teaching us more java bullcrap. But I think the open source development is indeed helpful there. If you want to
run something like a server, a quick glance at the code will tell you whether you really want to use this piece or search for another one.

Astalavista : Microsoft and its efforts to fight spyware has sparckled a huge debate over the Internet. Do you think it's somehow ironic that MS's IE is the number one reason for the existence of spyware. Would we see yet another industry build on MS's insecurities?

Eric : It's the only reasonable way for MS to react. Heh, they are just a company.

Astalavista : The Googlemania is still pretty hot. Are you somehow concerned about their one-page privacy policy, contradictive statements, and the lack of retention policies given the fact that they process the world's searches in the most advanced way and the U.S post 9/11 Internet wiretapping initiatives?

Eric : Yes I am, that's why their only product I use is the websearch function. As soon as I find another good website like google.

Astalavista: Thanks for your time Eric!
-----------------------------------------

Interview with Bjorn Andreasson, http://www.warindustries.com/

Astalavista : Hi Bjorn, would you please introducte yourself and share some more information about your background in the security world?

Bjorn : My name is Bjorn "phonic" Andreasson and I live in Sweden, I'm turning 22 this year. I've been a part of the so called "underground" since the age of 14 which gives a total of 8 years. I got my first computer at the age of 13 and I quickly got involved in Warez as my uncle showed me some basic stuff about the internet. After a while I realised Warez websites was "uncool" because of all the popups, porn ads, only trying to get as many clicks on your ads as possible to earn enough money to cover your phone bill. So, there I was viewing the Fringe of the web (www.webfringe.com) and I found all those wonderful h/p/v/c/a websites, which caught my eye. I knew I could do better than most of these guys as I had a lot of experience from the Warez scene -I knew how to attract visitors quickly. The first version of War Industries I belive was a total ripoff from Warforge.com as I didn't know better at the age of 15/16, I quickly understood this wasn't the way to do it so I made my first version of the War Industries and I might add it looked VERY ugly as I recall it:)

From there I have had several designers making new versions, trying to improve it and I belive we've acheived that goal now. It should be mentioned that during 2000 and 2003 War Industries was put on ice as I couldn't cover the expenses so it was only me and a friend keeping the name alive until 2003 when I relaunched the website and turned it into what it is today (Badass). I've also been a part of the Progenic.com crew as well. As Blackcode.com crew, it was practicly my work that made BC famous because I sent a shitload of hits to it back in '99 when WarIndustries received 4,000 unique hits on a daily basis. I also owned www.icqwar.com which held only ICQ war tools, some of my own creation, very basic but handy. The site had 3,000 unique hits on a daily basis after only one week online. After four weeks I got a letter from AOL to give me the domain name or being sued. What could I do? 16 years old, of course, I gave it away! Well that's pretty much my story.

Astalavista : WarIndustries.com has been around since 1998, nice to see that it's still alive.
What is the site's mission, is it hacking or security oriented? Shall we expect some quality stuff to be released in the future, too?

Bjorn : WarIndustries can't really be placed anywhere. It's either black, gray or white hat. I'd say we're a mix with a touch of them all. Our focus is to enlighten people in the means of programming, getting them to know google as their best friend. We've released a couple of video tutorials wich are very popular because they make things so easy. We're going to release a
couple of new ones soon, as soon as we get around to it as most of us got jobs and other stuff to attend to. Don't miss out on our brand new T-shirts coming up in a month! If you're something, you've got to have one of those!

Astalavista : What do you think has changed during all these years? Give a comparison between the scene back in 1998 as you knew it and today's global security industry, and is there a scene to talk about?

Bjorn : I'd say people are a way more enlightened today. Back in '98 you could pretty much do anything you liked without getting caught. Today you can't even download Warez without getting problems. I'd say there's a scene but very different from the oldschool I know. I am trying not to get involved and I have my own way. Maybe that's why WarIndustries is so popular.

Astalavista : Is Google evil, or let's put it this way, how can Google be evil? Why would Google want to be evil and what can we do about it if it starts getting too evil?

Bjorn : Google is not evil, Google is your best friend!

Astalavista : Give your comments on Microsoft's security ambitions given the fact that they've recently started competing in the anti-virus industry. They even introduced anti-spyware application - all this comming from MS?

Bjorn : If it wasn't for Microsoft, there wouldn't be viruses so I'm blaiming them for writing crap software. Why do they always leave a project unfinished and start another one? I mean Windows XP is working fine, why Longhorn? Why can't they make XP totally secure, like OpenBSD, there hasn't been a remote root exploit for many years as of what I've heard? That's security! If I didn't know better, I'd say MS is writing low-quality software so they can get
into the Anti-virus scene and make even more profits!

Astalavista : Recently, the EU has been actively debating software patents. Share your thoughts on this and the future of open-source software?

Bjorn : I can't make up my mind when it comes to Open/Closed source.There's benefits from both sides. Open source is fixed much quicker but also discovered way more often than closed. This is my opinion.

Astalavista : In conclusion, I would really appreciate if you share your comments about the Astalavista.com site and, particularly, about our security newsletter?

Bjorn : Actually, I haven't checked out Astalavista that much. I have known it for many years but I never got around. I promise I'll check it out!

Astalavista : Thanks for your time Bjorn!
--------------------------------------------

Interview with Bruce, http://www.dallascon.com/

Astalavista : Hi Bruce, would you please share with us some more information on your background in the security industry and what is DallasCon 2005 all about?

Bruce : Thanks for this opportunity. I have over 7 years of engineering experience working as a System's Engineer for companies such as Nortel Networks and Fujitsu. Realizing the importance of real information security training experince for everyday people, about 4 years ago a few colleagues and I decided to start truely academic Information Security Conference in Dallas and see what happens. We held the first DallasCon in 2002, just a few months after the tragic events of Septmber 11, 2001 in the U.S. The reponse was overwhelming with academic papers being presented from as far away as Russia and attending coming from countries such as Japan and China. Astalavista : There are so many active security cons and conferences out there that it is sometimes hard to decide which one is worth visiting. What, in your opinion, makes a con/conference qualified? Do you think that although there's nothing wrong with commercialization, some cons are becoming too commercial so they have lost sight of what their vision used to be in the very beginning of their history?

Bruce : Truly, I must admit the lure of money being thrown at many of similar conferneces such as ours is sometimes overwhelming. When a company such as Microsoft comes knocking on your door with a fist full of cash wanting to by into a Keynote speaker slot, it's hard to resist the temptation to give in. But we have tried to separate the academics from the commercial side. The training courses and the conference itself are designed to present the latest unbiased view of current trends in information security. We have a team of dedicated colleagues that read every paper carefully and look for flagrant promotions of certain technologies or companies. They also work very closely with the speakers who are chosen to present at DallasCon, to make
sure that they know what is expected from them. We do offer sponsorship opportunites to companies to help us carry the costs of such an event, but we try very hard to separate the business side from what people come to DallasCon for, which is the latest unbiased view of the trends and research in information security. I think many conferneces lose sight of what made
them big and forget their roots.

Astalavista : Like pretty much every organization, ChoicePoint or T-Mobile, keep a great deal of personal, often sensitive information about us, as citizens, students or employees. What actions do you think should be taken by the general public, the companies themselves and the government to ensure that the security within such databases or service providers is well beyond the acceptable level of security for most organizations?

Bruce : I think companies need to stop treating their customers like numbers and really put a face with the information that they are gathering. When someone gives you detailed information about themselves, they have put their trust in your company to protect them. When a breach is made, the cusomter feels betrayed and may never come back to you to do business. I laugh when I hear that huge muti-billion dollar companies are constantly having their cusotmer data stolen. I wonder how much they are really spending on security? How much are their cusotmers worth to them? These days it is hard to distinguish between legitiamte companies and fake ones online. It's funny, but people have trouble revealing their credit card information or social security number to a physical business down the street, but put the same business online and people throw that information at you without thinking twice. I think consumers need to stop taking security for granted and use some common sense. The first step of security is common sense...You can't put a price on that!

Astalavista : Two words - Symbian and malware - what are your assumptions for the future trends on the mobile malware front?

Bruce : I predict that it will be huge. The future of mobile OS is wide open and as the competition for market share grows, mobile companies want to offer anything they can in a smart-phone. I am always surprised as to what phones can do right now... in a few years, they might even serve us breakfast in bed! The downside is the huge vulnerability of the mobile-OS. First of all, more people own phones than computers around the world. It is the obvious next frontier for virus writers. Secondly, theoretically, it is much easier to infect an entire phone network than PC's. All you need is one infected phone syncking with a base station. Again, I go back to my previous answer, people need to use common sense... Do you really need to put your financial data or your sensitive e-mail on your phone?

Astalavista : What is your opinion about the mass introduction of biometrics on a world wide scale?

Bruce : Good - it will make security more individualized. We will all carry our security inside our DNA. Bad - it might increase the market for organ theft! (just kidding!)

Astalavista : In conclusion, I would appreciate if you share your comments about the Astalavista.com site, and particularly about this security publication?

Bruce : I have been visiting Astalavista.com for many years now, and I am very
impressed with the up to date cutting edge news, articles and really underground topics covered on your site. When we wanted to really reach out to the educated hacker community, Astalavista.com was the obvious choice. Thanks for putting us on your site and thanks for helping us promote our event.

Astalavista : You're welcome, wish you luck with the con!
-----------------------------

Interview with Nicolay Nedyalkov, http://www.iseca.org/

Astalavista : Hi Nicolay, would you, please, introduce yourself to our readers and share some info about your experience in the information security industry? Also what is ISECA all about?

Nicolay : My interest in information security dates back from 1996. At that time, respected Bulgarian experts from all over the country used to meet periodically at closed seminars where we exchanged our ideas and experience. At a later stage we developed the phreedom.org E-zine. I have also participated in numerous national and international mathematics and IT contests.

Currently I am a managing director for the R&D; department of one of Bulgaria’s most Prominent IT companies – Information Service. In 2002 I decided to initiate an InfoSec course at the University of Sofia. Once the course “Network Security? became part of the university’s curriculum, we immediately got the interest of over 500 students. During 2003, with the help of several experienced security colleagues of mine we developed another fresh and very useful course in “Secure programming?. Both of the courses fitted perfectly into the program curriculum and actually they attracted more students than we had expected. I am also teaching four other courses in Software technologies. As a whole, we contributed for the development of IT education in Bulgaria establishing the ISECA (Information Security Association), whose main purpose is to connect our members and inspire them to innovate, create, and enrich their personal knowledge, while being part of a unique community.

Astalavista : Correct me if I'm wrong but I believe not many Eastern European universities emphasize on the practicality of their computer and network security courses? What are your future plans for enriching the course selection further, and also integrating a more practical approach into your curriculum ?

Nicolay : During the last couple of years we have seen a definite slowdown in Europe regarding
information security courses and programmes. Until now we have already developed over eight courses, including the course Information Systems Security Audits, which is widely applicable. Furter, there is intensive work on the development of a new Network & Software Security Lab. We are also negotiating with ABA representatives for the introduction of a professional certification program – “Risk Management in the Financial and Banking Sector?

In fall 2005, University of Sofia will start a specialized master Information Security Program, coordinated by ISECA.

Astalavista : Who are the people behind ISECA, and what are the current local/global projects you're working on, or intend to develop in the upcoming future?

Nicolay : Our core members include certified security consultants and auditors, researchers, IS managers and class teaching professors. Among the key projects we’ve already developed or we are working on at the moment are:

- A National Laboratory for Network and Software Audits, being developed in close cooperation
with The University of Sofia. The lab will be used for audits and R&D; in the industry.
- An Information Security Portal – ISECA
- A National anti-spam system and its integration within international ones like SpamHouse
- Safeguarding the local business interests of information security and promoting its development on a government level
- Active participation in the development of the Bulgarian Law for E-trade and E-signature
- Subscription based “Vulnerability Notification? service
- Centralized log analysis and security monitoring

Astalavista : What is the current situation of the Bulgarian IT and Security market? What was it like 5 years ago, and is there an active security scene in the country?

Nicolay : We are currently witnessing a boom in the Bulgarian demand for information security services as a great number of businesses are realizing the importance of information security. On the other hand we are in a process of building strategical relationships with Bulgarian and multinational companies providing security related products and services. In the last couple of years official government bodies also have emphasized on sustaining secure communications. In response, our main goal in the upcoming future would be to build a collaborative working atmosphere with stable relationships between key partners and experts

Astalavista : Bulgaria and Eastern Europe have always been famous as a place where the
first computer viruses actually originated, to name the Dark Avenger as the most famous author. What do you think caused this - plain curiosity, outstanding programming skills, or you might have something else in mind?

Nicolay: It is a fact that Bulgaria is popular with its potential in the creation of viruses, trojans and malware at all. The thing is that there are a great number of highly skilled experts, who cannot apply their talent in the still growing local market; consequently they sometimes switch to the dark side. One of our main aims is namely to attract people with great potential and provide them with a professional and stable basis, on which they could develop themselves on the right track. The Bulgarian – Dark Avenger, well, he used to be an idol for the virus writers and the name still brings respect.

Astalavista : Is there an open-source scene in Bulgaria, how mature is it, and do you believe the country would be among the many other actively adopting open-source solutions in the future, for various government or nation's purposes?

Nicolay : Yes, there is a Free Software Society . Several municipalities have already
turned into E-municipalities with the help of open source software. There was a proposition for the introduction of a law for integrating open source software within the government’s administration, which was unfortunately rejected later on. Free Software Society is in close contact with various political movements, which reflects the overall support and understanding of open source from the society. The use of open source is also within the objectives of one of the main political parties in the country, a goal that resulted from the many initiatives undertaken by the Free Software Society. ISECA’s members are also active participants in the core direction of the FSS. We are currently developing a new opensource research team, part of Information Service – OSRT (Open-Source Research Team).

Astalavista : How skilled is the Bulgarian IT labor market and do you think there's a shortage of well - trained specialists in both IT and Information Security? How can this be tackled?

Nicolay : There are a great number of highly qualified software developers in Bulgaria, who created the Bulgarian Association for Software Developers. We have had numerous seminars and lectures between ISECA and the Association. One of our main objectives is namely to locate
and unite the highly qualified IT and Security experts within Bulgaria. Both organizations are constantly seeking to establish stable relations with international organizations with the idea to exchange experience and promote mutually beneficial partnerships.

Astalavista : India is among the well-known outsourcing countries for various IT
skills, while on the other hand the Bulgarian programmers are well- respected all over the world, winning international math and programming contests. Do you think an intangible asset like this should be taken more seriously by the Bulgarian Government, and what do you think would be the future trends?

Nicolay : Every year there is a leakage of highly qualitfied young professionals with great potential for growth, looking for further career development . The core reason for this “brainwave?, so painful for the Bulgharian econmy and society, is the lack of a relevant government policy, ensuring stable and beneficial career opportunities for the young generation. I honestly hope that further government policies, not only those related to the IT industry, would be successful in providing what a nation needs – a bright future for its brightest minds.

Astalavista : In conclusion, I wanted to ask you what is your opinion of the Astalavista.com's web site and, in particular, our security newsletter?

Nicolay : I have been visiting Astalavista.com since its early days and it is great to see that recently the portal has successfully established among the few serious and comprehensive sites. Furthermore, you can always find whatever you are looking for - software, as well as recommendations and shared experience in information security. I believe Bulgaria needs the same high quality portal, one of our main ideas behind ISECA.

Astalavista : Thanks for your time!
-------------------------------------

Interview with Roman Polesek, http://www.hakin9.org/

Astalavista : Hi Roman, would you please introduce yourself, share some info about your background in the security industry, and tell us what is Hakin9 all about?

Roman : My name is Roman Polesek, I am an editor-in-chief of the 'hakin9 - practical protection' magazine since Summer of 2004. I'm 27 years old if it does matter. This might be a bit surprising for folks who know our magazine well, but I'm more a journalist/editor (and that is my education) than a CS/security master. Of course, I worked as a sysadmin for some time,
use mainly Unices and code in several languages, but in the IT industry world I'm rather a self made man. I suppose I have no right to call myself "a hacker" in the proper meaning of the word. In short, 'hakin9' -- subtitled as "Hard Core IT Security Magazine" – aims to be a perfect source of strictly technical, IT security related quality information. We noticed that both the market and the community lack comprehensive, in-depth works on this topic. Decision was pretty simple: "Let's do it and let's do it good – we cannot fail". At the moment, with total circulation of nearly 50 thousand copies, we have 7 language versions. The magazine is available worldwide, by subscription or in distribution. However, it's important to remember that we are not encouraging anyone to commit any criminal acts. Beside disclaimers published in every issue of the mag, we emphasize on the legal matters wherever possible. We do not want to make a magazine for the so-called script-kiddies and assume that our readers are professionals and require some portion of knowledge to fully utilize magazine's content. On the other hand, as we all know, "The information wants to be free". 

There's no reason to avoid any particular subjects. Every article that precisely describes an attack technique includes a section that is to help defending from the threat we present. 'hakin9' is not only a magazine. The free cover CD is attached to every hardcopy. The disc includes a live Linux distribution called 'hakin9.live' along with plenty of useful documentation [RFCs, FYIs, HOWTOs] and a really huge amount of computer/network security applications. We also prepare our own tutorials that allow readers to exercise the techniques described in articles [only in their very own networks!]. Since the next issue of 'hakin9', the CD will also contain full versions of commercial applications for Windows. Athough we rarely use Microsoft Windows, we consider it useful and some of the readers requested such software. One of the articles from each issue is available for free, just to make sure anyone that buys 'hakin9' won't regret the purchase. See our website if you're interested in trying 'hakin9' articles.

Astalavista : What do you think are the critical success factors for a security oriented hard cover magazine?

Roman : I am convinced that the crucial matter is honesty. Our target readers are highly educated, extremely intelligent people and would easily recognize any marketing lies. We just do not say things that aren't true. Everyone can see what we publish and how we do it. The other important thing is diversity. It's obvious that creating a magazine that fits everybody is impossible. There will always be a guy that is not satisfied with, say, the cover story or the layout or anything else. This is nothing unusual, but should be expressed loud and
clear. That's why we cover different topics -- from e.g. attacks on Bluetooth stack, through data recovery in Linux or anti-cracking techniques for Windows programmers to methods of compromising EM emissions. Last but not least, the mother of all successes is making
people aware of magazines’ existence. Nobody would buy 'hakin9' unless they know we are available. But the main thing is that magazines like ours will never be mass publications, they have their niche that needs to be cultivated. The general rule -- for all press publishers, not only us -- is "Respect your readers and they will respect you". Selling many copies of one issue, using lies and misleading information, is not difficult. What's difficult is to make sure that users will consider you a professional who just makes a good magazine, not a travelling agent.

Astalavista : What is the current situation on Poland's IT and Security scene, and do you think it's developing in the right direction from your point of view, beside Poland's obvious anti-software patents policy?

Roman : Yes, "Thank you Poland" and all. It's always nice to know that someone in the world has positive connotations with your country. But I cannot give you any general overview of the Polish scene. It's just too diverse and I work with IT specialists from all over the world, so I do not concentrate on Poland particularly. After all, most of the important things happen in the USA. Really, the main problem in Poland is software piracy. I'm not talking about P2P networks specifically, I'm talking about the consciousness of Polish people. They are just not aware of the
fact that using cracked apps is a crime, a pure theft. I suppose this problem is present in all countries. And poverty does not justify such a procedure at all, we have plenty of free substitutes for even the most popular software. The Polish scene (I mean community by that, of course) is not very different from any other country. We do have a very strong group of open source ideologists (some might call them the followers of Richard Stallman :)), we do have some anti-patent people (I'd recommend http://7thguard.net for those who understand Polish). But we do not have any spectacular successes with any real inventions or discoveries (mind
that for now I'm talking about the community, not the corporations). I'd only mention two phenomena your readers might have heard of. One is the LSD, [Last Stage of Delirium] an independent research group known for pointing out bugs in Microsoft RPC some years ago. The other well known is Michal "lcamtuf" Zalewski, an author of a powerful passive network scanner called "p0f" and a set of very useful debugging/binary analysis called "fenris". The reason for this unimpressive situation is the fact that Poland was cut off from the capitalist world for nearly 50 years [and ENIAC was introduced in 1947], so we were isolated from real computing during that time. We just have to make these 50 years in the next few years. On the other hand, IT specialists from Poland -- say, programmers -- are considered very ingenious and good workers. For offshore corporations they are really attractive.

Astalavista : During 2004/2005 we've seen record breaking *reported* vulnerabilities. What do you think is the primary reason, increasing Internet population, programmers’ deepening their security knowledge, companies in a hurry to integrate more features with a trade-off in security or perhaps something else?

Roman : All of them. The increasing number of Internet users does not directly influence the number of vulns found, though. The new Internauts are mainly people who have never used computers and networks before. Of course the other thing is that Internet "aggregates" huge amounts of data, which was publicly unavailable before. There are more and more programmers and IT security specialists. Their population is constantly growing, be it because of the money they can earn or just the popularity of Computer Sciences. To be honest, most of them are at most average at their job, but for example people from India an China have great potential.
But you are right. Marketing and pressure for higher sales make companies work in a great hurry, they just don't care about average Joe Sixpack. And Joe Sixpack would hardly ever notice any security vulnerabilities, not mentioning they would probably never report such flaws. Finding bugs in software has also become some kind of a fashion these days. It's an intellectual challenge, similar to solving riddles. No wonder that along with the increasing number of people able to understand, say, the C code, the number of vulns reported increases. There is one more thing I'd like to mention. I suppose that the scale of reported vulns would appear far greater if proprietary software creators informed about all flaws found in their products. It's not in
their interest of course.

Astalavista : Thought or at least positioned to be secure, MAC's and Firefox browsers have started putting a lot of efforts to patch the numerous vulnerabilities that keep on getting reported. Is it the design of the software itself or the successful mass patching and early response procedures that matters most in these cases?

Roman : I have great respect for Apple products, though the only Mac I use is a very old Performa :), just for experiments with BSD distributions. I consider Macs secure in general. I also use Mozilla Firefox daily. I'd bet on the latter case, but like I said I'm no programming guru. The developers try to act fast and release patches as soon as possible, so at least average users can feel secure. The fact that there are plenty of developers makes it only better. Bugs in the code are not a nemesis themselves, you cannot avoid bugs in more complex applications. The only solution that makes sense for me is to conduct constant audits and release patches frequently. Look at the Microsoft Internet Explorer [I am aware this example is a
bit trivial]. I have a feeling that this company's ways of dealing with flaws is just childish, reminds me of covering your own eyes and hoping it will make yourself invisible to other kids on the playground. I'm not criticizing Microsoft at all -- it's just that the company with so many great specialists has problems with securing their code, and their software is the most popular solution in the world, no doubt. Apple is competing with Windows in general and Firefox tries to bite a part of the browser market. Looking at their financial and market share results makes me sure that the way the patches are done by these enterprises are the only right solution. Repeating that your product is secure and just better does not make it secure and better.

Astalavista : In may, a DNS glitch at Google forwarded its traffic to www.google.com.net (GoSearchGo.com) for 15 minutes. What are your comments about this event when it comes to security and mass DNS hijacking attempts on a large scale? Do you also picture a P3P enabled Google used on a large scale in the near future and do you fear that Google might be the next
data aggregator (they are to a certain extent) breached into?

Roman : The real point is -- DJB mentioned that in an interview for the next issue of 'hakin9' -- that some of the protocols we use, especially SMTP and DNS, are outdated. To be precise, they were outdated at the moment they were being created. It's nobody's fault. We have a saying in Poland that "Nobody is a prophet in his own country". Even Bill Gates didn't notice the potential of the Internet. I would say Google has really nothing to do with any DNS forgery. The protocol is flawful. What's worse, we can live without the problematic SMTP. Without DNS, which is a core of the Internet. For example, I just cannot imagine my mother using IP addresses to surf the WWW. I'm not afraid of threats to Google security. They have technology, they have money, they have ideas. I might say that it's Google, which will start and force security improvements in domain resolving mechanism. Daniel J. Bernstein claims that the first thing we should do is to implement some method of authentication in DNS protocol. Be it PKI, be it anything else -- we have to do it so that we would have some time to introduce a really secure DNS replacement. As for the hijacking itself, I consider it one of the most primitive kinds of abusing IT infrastructure. It's just like taking over somebody's house. It's as bad as deleting someone's data for sports or DDoS attacks used for fun and/or profit.

Astalavista : Anonymous P2P networks have been getting a lot of popularity recently namely because of RIAA's lawsuits on a mass scale. How thin do you think is the line between using P2P networks to circumvent censorship in Orwellian parts of the world, and the distribution of copyrighted materials?

Roman : 'hakin9' team likes P2P networks, the more anonymous, the better. We use them for distributing our free articles and our CD. It makes me laugh when **AAs send e-mails with legal threats based on the American legal system to Polish or Swedish citizens. Sometimes they're like an old blind man in the fog. Instead of adopting P2P for selling their video or music, they make the community angry. Digressions aside. I don't feel that P2P networks will help anyone make their transfers safe [security through obscurity, right?] and that they will help to fight censorship in countries like North Korea or even China. On the other side, I can imagine modifying XMPP [Jabber] protocol to transfer SSL-secured data -- it may be already done, I had no time to investigate it further. Unauthorized distribution of copyrighted content, however, will always be a problem. There's no way to prevent such behaviour. Recent events show us that writing a P2P client is a piece of cake, even a clever 9 years old boy can do this. I would rather make it easier for people to buy electronic copyrighted materials without the need to download it illegally. Regarding that according to some statistics even 30 per cent of total internet transfers are generated by P2P networks, I'm rather afraid that some stupid people downloading pr0n or Britney Spears MP3s could easily kill the Net some day. To sum up, each technology has its profits and costs. Obvious :). The profit of P2P is the ease of distributing any content. The cost is the people using it in an illegal manner. I can see no reason for prohibiting these network just because some people prefer bad quality motion pictures to going to the movies. Should we prohibit usage of knives only because of the fact that someone tabbed the kitchen knife in someone s stomach?

Astalavista : In conclusion, I wanted to ask you what is your opinion of the Astalavista.com's web site, in particular, our security newsletter?

Roman : I'm very impressed with the amount of data available for Astalavista's visitors. I'm not a member though, so I cannot really make a detailed review. To be honest, I had some problems with recognizing which of your websites are free and which ones are not. But I have managed to do it and use it almost daily :). As for the newsletter, it's one of the most informative and professional ones I have ever seen. Since having read Issue 16, I couldn't stop myself from reading the archives. I am a subscriber and strongly advise everybody to do the same. As a person professionally dealing with IT security, I mean it – this is not an advertisement for Astalavista. This is the truth.

Astalavista : Thanks for your time Roman!
---------------------------------------------

Interview with John Young, http://www.cryptome.org/

Astalavista : Hi John, would you, please, introduce yourself to our readers, share some info on your background, and tell us something more about what are Cryptome.org and the Eyeball-Series.org all about?

John : Cryptome was set up in June 1996, an outgrowth of the Cypherpunks mail list. Its original purpose was to publish hard to get documents on encryption and then gradually expanded to include documents on inforamtion security, intelligence, national security, privacy and freedom of expression. Its stated purpose now is: "Cryptome welcomes documents for publication that are prohibited by governments worldwide, in particular material on freedom of expression, privacy, cryptology, dual-use technologies, national security, intelligence, and secret governance -- open, secret and classified documents -- but not limited to those. Documents are removed from this site only by order served directly by a US court having jurisdiction. No court order has ever been served; any order served will be published here -- or elsewhere if gagged by order. Bluffs will be published if comical but otherwise ignored." The Eyeball Series was initiated in 2002 in response to the US government's removal of public documents and increased classification. Its intent is to show what can be obtained despite this clampdown.

Astalavista : What is your opinion about cyberterrorism in terms of platform for education, recrewting, propaganda and eventual real economic or life loses?

John : Cyberterrorism is a threat manufactured by government and business in a futile attempt to continue control of information and deny it to the public. Cyber media threatens authorities and authoritarians so it is demonized as if an enemy of the state, and, not least,
corporate profits.

Astalavista : A couple of words - privacy, data aggregation, data mining, terrorism fears and our constantly digitized lifes?

John : Privacy should be a right of citizens worldwide, in particular the right to keep government and business from gaining access to private information and personal data. The argument that government needs to violate privacy in order to assure security is a lie. The business of gathering private information by corporations and then selling that to government and other businesses is a great threat to civil liberties. Much of this technology was developed for intelligence and military uses but has since been expanded to include civil society.

Astalavista : Shouldn't the U.S be actively working on hydrogen power or alternative power sources instead of increasing its presence in the Middle East or to put the question in another way, what is the U.S doing in Iraq in your opinion? What do you think is the overall attitude of the average American towards these ambitions?

John : No question there should be energy sources as alternatives to the hegemonic fossil fuels. Dependence on fossil fuels is a rigged addiction of that worldwide cartel. Car ads are the most evil form of advertising, right up there with crippling disease of national security.

Astalavista : Is ECHELON still functioning in your opinion and what do you believe is the current state of global communications interception? Who's who and what are the actual capabilities?

John : Echelon continues to operate, and has gotten a giant boost since 9/11. The original 5 national beneficiaries -- US, UK, CA, AU and NZ -- have been supplemented by partial participation of other nations through global treaties to share information allegedly about terrorism. Terrorism is a bloated threat, manufactured to justify huge funding increases in
defense, law enforcement and intelligence budgest around the globe. Businesses which supply these agencies have thrived enormously, and some that were withering with the end of the Cold War have resurged in unprecedented profits, exceeding those of the Cold War.

Astalavista : Network-centric warfare and electronic warfare are already an active doctrine for the U.S government. How do you picture the upcoming future, both at land and space and might the Wargames scenario become reality some day?

John : Network wargames are as pointless and wasteful as Cold War wargames were. They churn activity and consume expensive resources. None are reality-based, that is, outside the reality of imaginary warfare.

Astalavista : Do you believe there's currently too much classified or declassified information, namely documents, maps, satellite imagery etc. available on the Net these days? In the post 9/11 world, this digital transparency is obviously very handy for both terrorists and governments, but who do you think is benefiting from it?

John : Far from being too much information available to the public, there is a diminishing amount, especially about exploitation of those who have access to classified and "privileged" information -- government and business -- and those who lack access. The concocted warning that open information aids terrorism is a canard of great legacy, one that is customarily spread during times of crisis, the very times when secret government expands and becomes less accountable. "National security" is the brand name of this cheat.

Astalavista : In conclusion, I wanted to ask you what is your opinion of the Astalavista.com's web site, in particular, our security newsletter?

John : Great site, very informative, give yourself a prize and a vacation at G8 with the world class bandits.

Astalavista : Thanks for your time John!

John : Thanks to you!
-----------------------

Continue reading →