When indulging in virtualization, recall that this practice (as opposed to using real computing with hardware) introduces at least three new categories of concern:
PROVIDER HYPERVISOR ISSUES
PROVIDER WEB INTERFACE ISSUES
PROVIDER PERSONNEL ISSUES
You will notice the repetition of the term "provider", since one definition of "cloud" is "renting someone else's box and network".
The first area is one I recall from a previous project in which we saw time delays in patching hypervisor vulnerabilities, which never happen except when they do. Hypervisors are the software programs that create and manage the virtual computing instances "living" on the real host. Ideally they prevent a user on one instance from getting into others, into the host, into the host's network, and so forth.
The second area I recall from the same project, which would not only bring up injection vulnerability but simple operations faults, like not providing a necessary choice menu or button, or having that control work improperly. There's also the issue of the interface's throughput capacity.
The third area notes that by using a provider for virtual needs (if that's what you're doing rather than running the host in your own co-lo arrangement), you go through a layer of employees and management you've never met and do not control.
.....
So yes. We sometimes don't recall these issues in the way they were first commonly discussed. And as we move forward, fewer will think of them and they'll become more important. Witness the youngsters we see referring to any device connection as "wifi", since soon they may not remember ethernet, being told of it only by somebody else who fixes something for them.
Sunday, November 26, 2017
Sunday, October 22, 2017
Go To The PUB
Here's my latest mnemonic which will make me rich, or not.
"Go to the PUB."
Although this is supposed to be a Linux blog, I often dip into questions of general computer security. I've been annoyed over the state of such matters, since zero-day exploits seem to be discovered daily or hourly. Cloud hypervisor weakness, DNS fakery, programmers forgetting to tell fields not to take nasty input (or the dev project not giving them time for testing in order to find and eliminate those instances - not to mention documentation)... wait a minute. What if I concentrate on the positive? What can we do that'll work?
P - use complex passwords and change them often.
U - perform updates and patching on all systems and applications, testing update or patch on a nonproduction box where feasible.
B - do backups at least of critical systems, file systems, configurations and settings.
My very basic list does not take the place of all other kinds of due diligence and due task completion. If a user or employee leaves, disable that account right now. Don't use any default passwords or configs on anything. Don't put info useful to the bad guys on the company website and don't let employees put same on their LinkedIn or Facebook pages. And so on. But use my mnemonic to keep the three biggies (according to me) always in mind:
Passwords. Updates. Backups.
End of file.
Thursday, June 15, 2017
A way they can drain your bank account - and a way they CAN'T
I caught this article that was referred to readers by PenTesting Magazine and originally came from The Register in the UK:
After Years Of Warnings...
It's about the protocol flaw that allows crook #2 to insert into financial transaction flows the logon/password/whatever information stolen from crook #1, who got the info from laptops, phones or desktops harboring the malware 'bots in crook #1's net. However, it occurred to me that although some bank customers would be vulnerable to the arrangement, there may be others that would not be. So I dropped by a local bank.
I described the situation in as-non-technical-as-possible terms and asked the loan official if it was plausible for customer immunity to result from a particular circumstance. An SS7 protocol vulnerability plus knowledge of logon credentials for an online banking account gives two crooks the opportunity to craft communication that looks like a request from the real customer for money. All one needs is the credential (or credential group) and the protocol hack (which the involved standards committee may spend months closing). But what if the list that crook #2 bought from crook #1 does not contain the credentials of customer X? Then customer X is immune.
How would this happen? The "harvester" malware operated by crook #1 looks for whatever it can find. If a particular customer, say 88 years old who's never set up an online banking profile, does business with checks, debit cards, credit cards, cash, whatever old fashioned way... then that customer would never have set up credentials with which to log onto any https site from the bank.
The loan official agreed that the lack of that information in the account holder's profile would be a problem for crooks since you can't steal what isn't there. I told her that I was interested to hear that, since the case of a customer that had not established an online profile with a financial institution described me as well. I like many types of technology but not the particular one being discussed. That's just me.
We also determined that fraud control software could possibly save the day, at least in the US for now. German banks have been seeing some successful attacks of the above type for a few months, but if the attack comes here (the US) from there, FC software might be able to tell from IP addresses that the malevolent request IP's don't match IPs from which the customer typically communicates. If it's smart enough to do that, it may even protect from attacks through closer servers in country (as well as apply contextual comparisons like 'why would a blind person buy a motorcycle?') At that point the bad guys experience something like
--- Interfere with transaction / Put up error message PLEASE CONTACT YOUR INSTITUTION / Write log entry / Run tracking script / Email admin --- .
After Years Of Warnings...
It's about the protocol flaw that allows crook #2 to insert into financial transaction flows the logon/password/whatever information stolen from crook #1, who got the info from laptops, phones or desktops harboring the malware 'bots in crook #1's net. However, it occurred to me that although some bank customers would be vulnerable to the arrangement, there may be others that would not be. So I dropped by a local bank.
I described the situation in as-non-technical-as-possible terms and asked the loan official if it was plausible for customer immunity to result from a particular circumstance. An SS7 protocol vulnerability plus knowledge of logon credentials for an online banking account gives two crooks the opportunity to craft communication that looks like a request from the real customer for money. All one needs is the credential (or credential group) and the protocol hack (which the involved standards committee may spend months closing). But what if the list that crook #2 bought from crook #1 does not contain the credentials of customer X? Then customer X is immune.
How would this happen? The "harvester" malware operated by crook #1 looks for whatever it can find. If a particular customer, say 88 years old who's never set up an online banking profile, does business with checks, debit cards, credit cards, cash, whatever old fashioned way... then that customer would never have set up credentials with which to log onto any https site from the bank.
The loan official agreed that the lack of that information in the account holder's profile would be a problem for crooks since you can't steal what isn't there. I told her that I was interested to hear that, since the case of a customer that had not established an online profile with a financial institution described me as well. I like many types of technology but not the particular one being discussed. That's just me.
We also determined that fraud control software could possibly save the day, at least in the US for now. German banks have been seeing some successful attacks of the above type for a few months, but if the attack comes here (the US) from there, FC software might be able to tell from IP addresses that the malevolent request IP's don't match IPs from which the customer typically communicates. If it's smart enough to do that, it may even protect from attacks through closer servers in country (as well as apply contextual comparisons like 'why would a blind person buy a motorcycle?') At that point the bad guys experience something like
--- Interfere with transaction / Put up error message PLEASE CONTACT YOUR INSTITUTION / Write log entry / Run tracking script / Email admin --- .
Friday, April 7, 2017
DRaaS
Software as a service, Platform as a service, Infrastructure as a service… might as well list Accounting as a service, HR as a service, Security as a service, Programming & Development as a service, Service as a service (actually that last isn’t a joke, as Customer Support has been offshored for many organizations now)… can every business process be outsourced or commoditized? I don’t know but I know that I haven’t seen much new – or old – in the service economy that compelled me to conclude that the benefits outweighed the hazards of paying outside sources for everything. But there may be a category now that makes more sense than many: Disaster Recovery as a Service.
Cloud providers can give you a rented virtual (and often the additional choice of rented physical) infrastructure. You can rent online storage for backups. You can dispense with information technology staffing by hiring server admin companies on an as-needed basis (I don’t recommend that but it’s a widespread practice). You can hire security experts as needed, hopefully before they’re needed. But what if there was a way to combine solutions for many of these needs into one strategy? As I understand it, Disaster Recovery as a Service uses a massive backup as a fix for not just hardware failure or power loss, but for many things this side of ddos mitigation (or other problems outside your network). One particular company with a booth I saw at a recent security conference appeared to work like Carbonite backup, except for your whole network inventory. All nodes (desktops, laptops, workstations, servers) plus all network devices like routers and switches are “cloned” at the provider’s data center. This idea stores not just data backups but whole operating system builds, with users, desktop environments, configurations, applications and stray documents. And in the network devices, all the addresses, routings, rules, configs and system versions are included. These are (in this particular company’s instance) not just snapshots restricted to one point in time, but constantly updated “clones” of All The Things.
A “Carbonite for your whole shop” approach would, as described here, seem to rely on lots of bandwidth to do all the constant updating (plus think cost for that in addition to network capability matters). Also, the securing of the connection to the provider location or cloud introduces an issue. The defense stance of the provider data center itself would constitute another. After all, grabbing backups has already proven profitable to criminals worldwide, who didn’t have to frontally attack a victim’s main arrangements. But there’s also promise in the approach. When your hardware and connectivity become ready after an event, you could come back from fire, flood, tornado, hurricane, earthquake, physical strikes like an eighteen-wheeler smashing through your office wall, node breakages induced by Windows Update, System Update or the like, worm damage, maliciously encrypted data blackmail and most problems related to geographical location (sinkholes?).
I can see potential challenges here with cost, security and network capacity. But if these can be handled then DRaaS is a new approach that could overtake legacy methods of the old offsite backup, reliable as it is. I’ll be watching the market for this product class with great interest.
Cloud providers can give you a rented virtual (and often the additional choice of rented physical) infrastructure. You can rent online storage for backups. You can dispense with information technology staffing by hiring server admin companies on an as-needed basis (I don’t recommend that but it’s a widespread practice). You can hire security experts as needed, hopefully before they’re needed. But what if there was a way to combine solutions for many of these needs into one strategy? As I understand it, Disaster Recovery as a Service uses a massive backup as a fix for not just hardware failure or power loss, but for many things this side of ddos mitigation (or other problems outside your network). One particular company with a booth I saw at a recent security conference appeared to work like Carbonite backup, except for your whole network inventory. All nodes (desktops, laptops, workstations, servers) plus all network devices like routers and switches are “cloned” at the provider’s data center. This idea stores not just data backups but whole operating system builds, with users, desktop environments, configurations, applications and stray documents. And in the network devices, all the addresses, routings, rules, configs and system versions are included. These are (in this particular company’s instance) not just snapshots restricted to one point in time, but constantly updated “clones” of All The Things.
A “Carbonite for your whole shop” approach would, as described here, seem to rely on lots of bandwidth to do all the constant updating (plus think cost for that in addition to network capability matters). Also, the securing of the connection to the provider location or cloud introduces an issue. The defense stance of the provider data center itself would constitute another. After all, grabbing backups has already proven profitable to criminals worldwide, who didn’t have to frontally attack a victim’s main arrangements. But there’s also promise in the approach. When your hardware and connectivity become ready after an event, you could come back from fire, flood, tornado, hurricane, earthquake, physical strikes like an eighteen-wheeler smashing through your office wall, node breakages induced by Windows Update, System Update or the like, worm damage, maliciously encrypted data blackmail and most problems related to geographical location (sinkholes?).
I can see potential challenges here with cost, security and network capacity. But if these can be handled then DRaaS is a new approach that could overtake legacy methods of the old offsite backup, reliable as it is. I’ll be watching the market for this product class with great interest.
Subscribe to:
Posts (Atom)