Rank Speculations Prompting My Impending Win10 Switch

No, I'm not changing my advocacy position any. I still hate everything. But I'm now having to look at the Win10 upgrade situation due to Win7 going out of support in a few weeks (3 of my 11 currently operational boxes run some Windows or other). Is that really needed? Yes; most security problems statistically target the Win7 release. BUT going to 10 brings up a new set of problems.

(If you're interested I'm looking at buying at least one preloaded computer offlease (used) from either discountelectronics.com, tigerdirect.com, microcenter.com or officedepot.com).

Windows 10 is extremely chatty in that it monitors user activity for various reasons and excuses. Fortunately, there are lots of Win10 telemetry restriction programs, scripts and procedures available via a simple web search (I'll do a further post on some). But I speculate that it's more necessary than normal that you look into Win10 security due to the new chattiness, for the following reasons.

Unlike in the past, Windows 10 monitors user activity as well as security stance with various installed tools including a keystroke logger. This means that it sends data to Microsoft for later analysis.

But note that if this shuffling (telemetry) happens, then that means two other things. First, that it gets transmitted over probably-insecure, probably-unencrypted channels. That transmission provides the opportunity for someone to use the good-ol' MITM attack. If you don't know what that is, Goo... no, Yandex it.

And then there's a third problem I haven't seen discussed much. Microsoft would, after harvesting the info, store it somewhere. It's that storage location I wonder about. Years ago, Microsoft lost the source code to a break-in when somebody got into their network at Richmond, WA - but not directly. Rather than hit MS servers frontally, the sneaks got hold of an employee list and located a manager working from home. That's right. Security wasn't quite as good on the home laptop or desktop, so they hacked the manager. Getting in via his credentials, they swiped all of Win98SE, I think it was. Oh, I forget. Goo... no, Yandex it. And I dunno; maybe Win10 is 90% Win98SE.

This last holds the greatest number of possibilities for future bad guys in my view. Cook up a... let's call it a "Prospector Program" that searches for addresses of databases and storage locations (network, attached device, cloud, whatever). Then set up a humungous data repository for it to use as a depot. Give it an obscured and encrypted communications method. Then run the program 24x7x365 at a low-intensity level of pings, attempts, etc. You're not hitting the main web interfaces or firewalls aggressively. You're hitting a secondary area that's not being DDoS'd in spectacular fashion, for example. There's a greater possibility of overstressed admins having their backs turned.

Just a few thoughts.

Long Term Cyber Security Risk

Assume that you, on your end (company or individual) are doing everything right. You're not clicking on unknown links in emails, you're not opening any attachment from suspicious parties and you aren't going to any bad sites you shouldn't be. At least not on company time and if so, using a virtual machine that can be ditched if necessary AND with documented permission from immediate management.

But what about the party on the other end? What about companies with which your organization does business? What about organizations you don't control? Here's a nice list of issues:

Alexa/Google type assistants
Hospitals
Government organizations
businesses you shop with
Financial institutions
Phone, VPN and communications providers
Businesses purchased that haven't integrated their networks with the new owner securely yet
Email providers
Social Networks

Well? Are you sure all those parties are taking good care of your personal information? Even if an APT (advanced persistent threat) isn't interested in you, various scummy individuals and groups are looking for your info all the time, if only to resell it to another creep. I'll call this risk an "organization leak".

There's also the tendency of newer networking protocols to track your location more effectively. Things like your DOB or credit card number can be guessed by random generators. And cameras or phones pointed at you by somebody else (person or business) could save images or other recordings of you and not require your permission to do so. Put that together with facial recognition (or voice recognition if they have enough to go on) and that's another category of captured information you don't control. I'll call this risk "analysis exposure".

Given the environment of saved data above, with files and files being created everywhere regarding you while being identified with at least some of your personal information attached or associated, imagine that some time later, somebody gets interested in you. At that time, might they get hold of a super database harvesting script that spent, oh, 60 days prospecting around the 'net for anything it could find? And remember: this example presumes a third or fourth party completely unrelated to the organizations that collected or originated the data (a party that merely takes advantage of lack of organizational security, updates or oversight). I'll call this risk "data inventory exposure".

And do you use cloud storage? I'll call this risk "backup location exposure".

And in the near future, will it no longer be possible to buy a gizmo that's not wireless? Wired-only or no-connectivity options exist for various devices now but imagine if cost and convenience force out the availability of a power switch or card slot by which you could opt out of the info flow? I'll call this risk "transmission jailing".

So if in the long run there's no actual security anymore, consider that there MIGHT be if you try to keep a secret by not dealing with it over channels you can't prove are secure. I'll not recommend anything but then, I don't know what channels you use anyway. If you need to be secure about something, it might be best to go out-of-band... depending on what band is normal for you. Carrier pigeon? Marconi? Tin can telephone? Smoke signal? I have no inkling of what will work in your case. But then, the bad guy probably won't either.

"But I Don't Have Any Information Anyone Would Be Interested In..."

Amazon and Google offer convenience devices that listen for your spoken commands, transmitting for analysis all captured sounds to the web. If a crime is committed at your location, this information could be subpoenaed at least in certain circumstances (precedents are still being established)...

One Of Many Cases, This One From 2017 In Case You Missed It

But app(lication)s are now being developed to intercept the audio and use it for, oh, perhaps nefarious intent...

Eavesdropping And Password Phishing O Matic A Tron

Fortunately these were just proof-of-concept dev exercises and we ALL KNOW THAT THERE ARE NO SUCH SCRIPTS OR PROGRAMS IN THE WILD AT THIS TIME NO THAT'S ABSOLUTELY IMPOSSIBLE IT'LL NEVER HAPPEN IN A MILLION YEARS.

I don't make these stories up; I just report them.

Don't bother to look for it on distrowatch.com - it's not there (at least it's not on the top 100 list sidebar on the right of the page). I actually can't remember how I heard about this one. It was probably in an article with a name like "top ten oddball linux distros". But it does exist.

If you do a search or two, you can still find Hannah Montana Linux.

I'll not bother to link to the download mirrors, since the Kubuntu base system appears to date from the kid's show character in its title, which would be around ten years ago. Running apt-get didn't locate much of the guts, so the thing isn't quite supported these days. Anyway, other than a garishly-colored installer, its main feature appears to be desktop wallpaper in purples and yellows.

This blast from somebody's past inspired me to look up some things that are still (kind of) around:

jihad.net - the game lampooning some "Barney" character that used to drive parents to the brink of sanity
hamsterdance.com - those dancing critters that we discovered when the 'net was new
wakeuplaughing.com - here's Steve Baherman's character Swami Beyondananda... religion jokes R us.
plan9 - Introducing Plan 9! The only OS named after an Edward D. Wood film that must have cost all of $300 to shoot
Intercal Programming Language - a joke that actually compiles... sort of
old "Conspiracy Theory" film promo page - at the link tab marked "???" there's a theory generator form that doesn't really work anymore, but somebody could probably figure out how to move it to a working location. Much funnier than the film (which sort of had its moments).

Toward A More Secure Account

You may have heard of this trick before, but many may have not - or maybe it was heard but didn't quite sink in.

When an account you're setting up demands answers to security questions such as "What was the name of your paternal grandfather?", you often don't need to provide answers that make sense. Very often (and I've never seen a contrary example) these questions accept nonsensical answers or even gibberish.

Consider such answers as...

Favorite flavor of ice cream? Pistachio
Favorite flavor of ice cream? pistachio
Favorite flavor of ice cream? Lyndon B. Johnson
Favorite flavor of ice cream? Johnson B. Lyndon
Favorite flavor of ice cream?
4#$53@6#$%23$35andapartridgeinapeartree

In my experience, any of these answers would be accepted by the script that generated the questions. Try it out to see what will be accepted. The worst that could happen would be to get an error message that would specify the local rules set up by some administrator. But I suspect that what you come up with just goes into a text field that accepts most anything.

The Security Predicament

The more I follow network security issues, the bigger the job of security appears. Online business activity has been with us since the 1990‘s and many managerial structures still don’t have Chief Information Officers, much less Chief Information Security Officers. Even if these positions exist, authority is limited. As long as InfoSec isn’t represented in the board room (and is considered a second-tier matter - a cost to be minimized), as users we’re on our own. Other than compliance with policy in order to satisfy the boss, there is a responsibility to ourselves to handle security better than do our organizations.

My latest formula with which to observe the broad security situation is this: there are three zones of concern, namely You, Them and the Connection between You and Them.

You - this includes any account or device under your direct control or ownership.

Your Connection - this is the Internet Service Provider, or more properly the server(s) through which you get to the outside world, operated by their administrator or administrators.

Them - this is the other end of the conversation, including businesses, government entities or other individuals or groups served by their Connections.

Problems are possible in any of the zones, but we should consider mitigation possible in only two of them. Let’s say you’ve locked down your own devices and are using best practices. Let’s also say the server admin between you and the world is also locked down and behaving cautiously. What happens next? You connect with someone or something outside the control of either you or the admin.

One can affect or at least observe problems at the position of oneself or one’s own connection to others. The situation on the other side of the connection is anyone’s guess. So:

1. Maintain your own material and situation as best you can, using my “go to the PUB” advice (pay attention to Passwords, Updates and Backups).
2. Use whatever influence you have to assure the quality of your Connection, and attempt to give out as little information as possible through this connection to the other end of the communication.
3. Monitor the situation with the people and organizations with which you communicate, and regarding the information you’ve given to these organizations and which you therefore no longer control. For example, watch your credit card statement and get with that institution in case of bogus charges. Challenge inaccurate information about yourself.

... It looks like maintaining your stuff, giving out as little info as possible and monitoring the other end would be the only three courses of action capable of improving network security. At least relative to the user. In the larger world, it’s still the wild west and could become even more so. There are APT’s (state-sponsored bad actors), organized crime elements, software bugs, hardware bugs, poor decisions within software development projects, political protest hacks, social media abuse, natural disasters, program or code incompatibilities and more things that won’t fix themselves.

We’re on our own.

FREE RANSOMWARE MITIGATION TOOLS

Here's a site that helps if one of your machines has been struck with a ransom program that encrypts your information - or claims to have done so:

Malware Hunt Team

In order to identify the problem you can upload code snippets or other associated info, like ransom notes or email addresses. Keys to decrypt your machine may be available immediately.

Firewall Adventures

So my - ok, one of my - bottom tier computers which was running the pfsense firewall will now get a new and different firewall for me to play with. Apparently pfsense no longer supports architecture below 64 bit, or I can't find the link to the older-box versions. So I blew it away and installed ipfire, with which I have no experience and know nobody with any (though I haven't yet brought it up at the Linux club). Figured I'd wreck it a little first.

The box is of 2005 vintage, a Dell of the WinXP era. Maybe the installer didn't expect that, since although the root and admin passwords were accepted by it during the setup routine, neither of them worked on reboot. On reinstall, root worked but not admin - and passwd informed me that such a user was not present, as in not even created. But CLI works and blinky lights are happening on the downstream router. I'll update within this post below as I discover how this new-to-me product works; it's evidently maintained by a company that has both supported and free versions.

UPDATE #1, 9/8
After one or two reboots and/or reinstalls, the installer kept putting in a root password that the system wouldn't remember. A forum suggested entering the password during installation without using the "Return" to get to the next line, but using "Tab" instead. The theory was that "Return" might insert screwy control characters but that "Tab" would not. This seems to have been true, fixing the root PW creation issue. I had to add the "admin" user manually (via useradd, not the web interface) but it seems to be successfully sticking as well. Now running through as many simple commands as I can think of, and it's ok after a half dozen reboots. I have an iso of Smoothwall in case something craters me later.

UPDATE #2, 9/12
And it forgot the root password again some more repeatedly... so I'm giving up on the old Dell (a GX520 Optiplex) and am now trying ipFire on a Dimension 2400 of equally ancient vintage but better specs (faster proc at 2.6ghz Celeron D and more memory at 2g). The ncurses based installer worked after the 4th or 5th attempt and the root PW has been remembered for days now. No routing to switch yet but pinging out and GUI adds/removes rules; will do a new post when most things work and there's news to report.

UPDATE #3, 10/8
Holy ruleset, Batman: this is all a bit more complex than I figgered. Routing out to the world is fine but the intrusion detection engine isn't turning over. Simple fw rules are operational through the GUI AFAIK and can test, so all seems ok with this package and box. BUUUT I was really interested in trying out its built-in IDS/IPS (intrusion and detection) which both uses signatures and behavior methods of detection/blocking (this would provide another perspective in the ongoing architecture debate between Snort and its later rivals). See, they used to use the venerable Snort but changed to Suricata a few releases back, so I dug up the command line commands for that. I think Suricata's config file was mangled at installation; the good ol' linux locate(updatedb) command verifies that the config file is where it's expected to reside and simple things like versioning display with -V happen right. I even catted the whole thing and it looks complete to my untrained eye. IPS won't run, though.

In my defense, I'd still be running pfSense if they had continued with the 32 bit version (with which all services ran when I asked them to); I just may get some raspberry Pi or other and throw pfSense on there - unless I reinstall IPFire and get it to run. Wish me luck! Until a better theory comes along, I'll blame Dell.

More Good Than Bad

Here's an article from Foreign Policy magazine that's better than the usual take on computer security problems. The writer commits the common error of tracing computer warfare oversight mistakes primarily to recent US Presidential administrations (when protocol vulnerabilities in TCP/IP date from about the time Stevie Wonder released "Livin' For The City" - RFC 675, Specification of Internet Transmission Control Program, December 1974). There's enough blame to go around. But what's properly covered by the article is considerable: the author points out the need for a "digital Geneva Convention" agreement so we'll have a guideline that identifies hostile action in a network context. That would help protect penetration testers and other cybersecurity researchers from unfair prosecution.

She even apparently coins a new and useful definition: "Cyberwar is the continuation of kinetic war by plausibly deniable means". Tarah Wheeler's article also confirms some of my own gripes of the past few years.

I'd prefer that it didn't.

Let's Get Specific

The previous post pitched the idea that a shifty operator might craft a customized attack on each of the citizens individually in a target area, region, city or even country that had a digital presence or litter trail. These days, that could be most people. Once every citizen in the target zone had a file built, a script could run a series of attacks on citizens using the file information on say, person 349384. In sequence, that script could try password cracks on email accounts, simple google searches on the uncontrolled net, requests for city services changes or disconnections, stop payments on checks or debit card uses, cancellation of credit cards, intentional violations introduced so as to trigger fraud alerts interrupting service... and so on.

Ever see the film Pacific Heights (the one I mentioned two posts ago under "Prediction")? It's from 1990. Released prior to internet growth, it shows how a dishonest renter goes after the property owner with legal and municipal trickery. All very low-tech. And as I also indicate earlier, a personalized digital Pearl Harbor sneak attack could just be the equivalent of misplacing your digital "wallet" - except that it could happen to 70% of the population at the same time. Add to that some assorted nationwide traffic signal and industrial control misconfigurations and you've at least got a rough commute home.

Anyway, to pull off the personalized attack you'd need the information on the marks before starting. So what would an assembled, finished citizen file have in it? Oh, maybe something like this:

name
address
city
state
country
previous addresses
phone number(s)
phone provider
previous phone providers
smart phone install application list
known email addresses
birthdate
tax number or SSN
DMV license
lawsuit case numbers
previous names
previous phone numbers
voter registration info
previous voter registration info
party primary affiliation from voter registration
employer
previous employers
declared income
religious or PAC memberships or affiliations
military service
hospital record control numbers
bank customer info or profile
insurance company customer info or profile
brokerage company customer info or profile
union membership info or profile
degrees or certifications from posted resumes/CV's
entire content of posted resumes if available connections from known email to social media accounts
connections from known email to conventional HTML posting boards
internet service provider
previous internet service providers
social media screen names if different from account name
charitable contributions or affiliations
any previous web activity recorded by archive.org

--- What? A world in which information on someone or something from many sources could be combined in one place? Not possible, you say. Larry Ellison says we got there five or six years ago.

Broadly, the issue is that much of our personal information is stored by businesses or public entities that have poor security practices. We should clean up our security act, of course, but as to information compromise, that ship has probably already sailed. We should assume compromise and proceed from there.

[What can one do? My earlier post here keeps it simple.]

Prediction

Ok, here's a problem situation of which I feel comfortable in predicting the rise, since I'm sure scads of persons have already thought of it.

Suppose a government military agency of a country not friendly with us were to develop a data mining capability extensive in nature and well-funded. Suppose that they were to understand that the mining itself could be weaponized and that one need not develop a cloud or botnet to distributed-denial-of-service (DDOS) backbone servers of a country's infrastructure "off the air", so to speak... but to attack in a way that avoids the network completely.

Suppose that said agency were to realize that the number of citizens in Country X (like ours) was not a terribly large number given the scale upon which a computer can operate. Suppose it were to build a file (using known data breaches and publicly available information) on every citizen in this country. With those files as targets, one simply could then prepare a rudimentary "identity attack" script to mess with every citizen's digital presence. Some citizens would not have a presence yet (being toddlers) but many at even a young age now have smart phones, laptops, smart TVs and so forth - lots of things with IP addresses. And the parents, who function as their own NETWORK ADMINISTRATORS, are possibly not current on their firewall rule skills... or any others...

The file on every person could contain email addresses, IMEI device numbers for cell phones, MAC addresses for desktop or laptop computers, social security numbers and birth dates (particularly if intimate processes like tax filing had been done via smart phone) and if a real name and public viewability were part of a Facebook or other social media presence then that would be interesting to include as well. There was a movie years ago called "Pacific Heights" (Melanie Griffith, Michael Keaton, Tippi Hedren) which told of a renter that tormented his landlord by using every low-tech form of harassment imaginable. This was in 1990 so the 'net as we know it had not arrived (pre dub dub dub popularity). The tormentor used such things as junk (snail) mail, the city complaint process and physical blocking of nearby driveways to create a buildup of problems in the lives of the property owners. The same sort of mischief could be leveled at the lives of citizens person-by-person with scripted attacks to change account passwords, delete address books and perhaps close credit card accounts.

Consider how many people have had the same email account for years and use the same simple password for many different things. Consider how many people do banking, insurance and other bill payment over computers or phones. Consider how insecure government and medical records no doubt are. Banks are probably the most secure overall as electronic entities in society but you hear of a breach at least a few times a year at some financial institution.

I'll call it, not DDOS - distributed denial of service but PDOS - personal denial of service. Simple scripted attack directed at only one could become like losing one's purse or wallet.

And everybody in the target country could lose their stuff all at the same time...

One Wishes One Didn't Have To Repeat This...

...but just as in the days around five years ago or ten, when virtual computing was this new thing promising cheap, automatic solutions for everybody's issues, we STILL see three pesky security problems which virtualization adds to ALL THE OTHER SECURITY PROBLEMS that were present in computing in the first place. Here they are again.

THE USER INTERFACE

The place you go to remotely administer a rented server at some unknown location (maybe they'll tell you which data center the virtual machine's in; maybe it's not an issue) is a web page, with all the inherent vulnerabilities those things have. SQL injections, buffer overflows - the usual suspects. Does your infrastructure provider use secure coding practices? Maybe, maybe not.

THE HOST HYPERVISOR

The big program inside which the virtual computers live is called the hypervisor. It's a very big program. Programs - particularly those that talk to networks - are vulnerable to all kinds of nasties. Updates to those programs are needed to counteract the nasties. Is the hypervisor program on the hardware host at your provider that runs your VM updated? Was it written by the virtualization product maintainer using secure coding practices? Maybe, maybe not.

THE PROVIDER EMPLOYEES

Did you hire the people that run the hosts that your VM lives on? No? Then you can't fire them. And don't even know who most or any of them are. Do you trust them? Maybe, maybe not.

Other Concerns

Do you maintain your VMs via an automatic payment from a credit card? What happens if a payment fails to go through? POOF - all your VMs could disappear, along with settings, data, transactions, virtual switches and so on. That's a nasty surprise, particularly if your backup locations are also VMs at the same provider that are paid for in the same way. And unless you're paying through the nose for managed hosting (where designated admins do stuff for you), there's the nasty surprise of lack of administration, meaning that you're behind on updates, disk space checks, disabling of unneeded services, log rotation and all that stuff.

Not to bug you, but these things haven't changed since years ago, when first I griped about them. Happy networking!

UPDATE: Another issue I remember from my tech support days is where a certain major infrastructure provider only a few years ago was discovered to be recycling VM's! OS loads at the provider where I used to work took about as long as a real computer (30-45 min.). A way to improve that - which they may have implemented by now - would be to image a new machine quickly from a master image. But one of our competitors was providing (apparently) already-built builds of Windows Server that had been previously used by an earlier customer. To recycle, I suppose they just ran some command that reset to defaults. Perhaps they came up with a powershell script. It would have provided a "new" computer (virtual machine image) to a new customer who was no doubt impressed by the speedy delivery! But that same customer may have been confused by the data, configurations and users left in the build from some previous owner. Hilarious.

A few days ago on the radio...

Remember listening to the radio? Sure you do. I, in fact, get much of my news there since I haven't thrown together an HDTV antenna yet. But that's another story. I use the internet mostly for YouTube... Anyway, at this writing the latest and record-setting (a few weeks) government shutdown has just ended for a planned 3-week hiatus to get paychecks through to various agencies. A radio news story I heard a few days before the agreement worried that since the government services that maintain "do-not-call" registries would not be open for business, robocalls would be worse during the shutdown's duration.

If only journalists would look stuff up.

["Buuuuuut nooooooooooooooooooo..." - noted philosopher John Belushi]

It is beyond the scope of this post to note all the ways that telemarketers have gotten around the "do-not-call" registries, but it's worth noting that there's a different issue with the recent spate of robotic sales calls, many in languages other than the one you speak. They're coming through land lines, landline equivalent arrangements, cell phones and anything else that uses a telephone number. The operative concept here is "telephone", which predates the "smart" phone by quite a bit. Back in olden times, specifically the middle Leisure Suit era, there appeared a communications method called SS7, which did not anticipate computer control of phone switching networks. Actually that wasn't the problem. The problem only a few years back was that the standards committee folk that maintained SS7 in current times couldn't agree as to how to fix certain flaws...

Wikipedia's article on SS7

(This is not an endorsement of any online encyclopedia using lightly-vetted update arrangements; it was a better-than-average article at the time of this writing at least.)

So until a fix for the vulnerabilities/features of SS7 is produced, the robocall outbreak will continue regardless of the presence or absence of do-not-call lists, which address a different problem anyway.