A Simple Analogy

Many technically competent people with whom I speak persist in the belief that online communications (web pages, email, VPNs) are secure. They are of course right... and wrong, depending upon several issues. Here's an analogy which either is original with me, or bears repeating if I've stolen it.

Imagine a tin can telephone system; that's our network analogy. There's a sending point, a point of reception and a communications route (encrypted tunnel, in our properly configured case). The tunnel is where the people that assume secure states are right. That encryption will prove really hard to crack. While anything can be defeated in theory, modern big-key systems will approach absolute uncrackability at current levels of technology.

But the tunnel is the middle point of this three-point system. There's also the transmission and reception points (the cans), being with the sender and the reciever of the message. The devices at those two points are where almost all questions of maintenance reside. In banking, the reception end is most often the institution, where InfoTech people are hired specifically to keep the nodes, servers, systems, switches, etc. properly configured, patched and monitored. You'd naturally assume a problem at the other end of this financial communication: the customer doing his banking (and personal social media stuff, email, shopping, census response, tax filing, etc.) on the same desktop on which his son plays online gaming. Antivirus? Too expensive! All bets are off where that PC is concerned.

And if there's a transaction involving a very careful user (you or me, maybe using a sacrifice VM on which to communicate in a paranoid mood) but a questionable recieving end (a local or county/tribal government agency), then there's either a management issue, a budgetary problem or something else to consider. So the two endpoints can be a problem even in the era of easy encryption. BUT there are two additional considerations beyond the current state of the endpoints.

First, there's the future state of the endpoints. Even if all config checks, patching, firewalling etc. have been checked, what about tomorrow? Zero day hits? New patches? New knowledge base releases prior to patches? New releases of software keys or default passwords on the dark channels? What if the cracker doesn't enter the network via the PC we're scrutinizing but via the router or a webcam or a web-enabled Barbie or GIJoe toy? Or the smart TV? Or audio streaming section of the stereo receiver? According to Leftronic, 127 new IOT devices connect to the web every second, meaning that load on networks increases steadily.

And second, there's data creation. If previous data, copies, emails, messages, other communications, login states or something is piling up on one end of the pipe regarding the person or organization at the other end of the pipe, then I (as a nasty actor) might be very interested in sneaking into some storage location and dd'ing all that stuff for later analysis. And it could be a relatively slow and quiet hack, since any Intrusion Detection regime would probably be more interested in the live network than in HDDs sitting around half-idle. And speculatively, perhaps I could use the stolen items now... or sell them later.

So there are various points about which to consider issues: sending point, tunnel (transmission point), receiving point, patching/monitoring/version issues for all points and data creation.

Oh. I forgot backup... and encryption for the backups - and to park the backups at a location NOT ON THE PRIMARY NETWORK WITH EVERYTHING ELSE. But then everybody forgets all that.

OpenSUSE Leap 15.0

This new desktop incarnation of OpenSUSE Linux successfully installed on a Core 2 Duo Dell box of about 10 years' age. I'm finding various oddball items of behavior but it's generally solid.

This load is my first experience with the Brave web browser, which defaults to several good security practices such as searching for HTTPS connections wherever possible. It's a rewrite of Chrome minus several... questionable practices. My only trouble with it would be the practice of closing the bookmark menu any time a change is made, requiring the user to re-enter the menu, unlike Firefox which doesn't close the menu after creation of folders, for instance.

When connecting a camera (Android in this case), I've been seeing intermittent connections for both charging and transferring pictures. And when pics successfully transfer, it's possible only by "manually" right-clicking on the file and doing a move to a home directory. Within the graphics program, the move or copy always fails, so I don't open it until after the move or copy is done.

In YAST (yet another setup tool), the Software Update app has no obvious refresh control, but several hidden in the dropdown menus which usually work. A equivalent tray symbol, a circle with an "UP" arrow in it - with a blue dot indicator - has proven stable so far, though, for noting when the system detects an update ready for installation.

I haven't been able to configure the wireless NIC yet, although the system did detect nearby networks with no problem (this issue could just be me).

I did like the Security & Hardening Center app, though, which is extensive and uncomplicated. Overall this version of OpenSUSE would not be a system for a newbie but is stable (no crashes so far after about 3 weeks of testing) and with further debugging looks to be an interesting contender in the desktop Linux race.

Fresh Rethink

In the technical sense, what is security? Or, what are the most common categories of activity in which the issue comes up? Secure coding practices? Networks? Email? Insider threats? Domain registration/hijacking? All those are contenders but let's look at four examples I've personally seen or heard testimony regarding from those that were involved.

DDOS ATTACKS

Distributed Denial Of Service attacks, in which a bad guy tries to knock you off the air, are persistent and automated. There are many protection services such as Cloudflare that offer access to defense networks for a fee. Your internet service or cloud provider may have filtration devices (network appliances) in a network operations center that can be temporarily effective. Your administrator - if you have one - may know of onboard options in your server or desktop/tablet/phone operating systems that can help, like firewalls, but recall that firewalls are only as good as the rules maintained by the administrator. Also, firewalling is not usually a network-related but a local damage control approach, at least from the end user's perspective.

RANSOMWARE

A stealth attack or a click by an employee on a bad email link can result in the presence of an outside program that can encrypt valuable information. The perpetrator then demands a fee for MAYBE restoring the data (and the encryption method may have inadvertently destroyed some of the data in the process). I think the only way to protect against this sort of thing that offers a high degree of success is an effective backup strategy. Saving all data, configurations and network information in secure, out-of-band or offsite areas gives you the ability to bounce back from most issues. It's business continuity.

CLOUD ISSUES: disappearance

I was told a story by someone involved that a company had a network of virtual computer instances along with virtual routers and switches at a major cloud provider. The company didn't pay its provider bill one month. A few days after the deadline, 32 instances and their related virtual network components simply went away. Vanished. Backups existed and were current. But it took a week to rebuild all the nodes of various kinds. Could your organization survive a week of customer interruption? The cause was an accounting error, producing a sort of security issue. But it's really a continuity issue.

CLOUD ISSUES: hypervisor code

I was witness to a problem at a provider that ran a popular hypervisor on the large servers on which it created virtual computers that were then rented to end users. A coding problem caused by the company that wrote and maintained the hypervisor program was identified that took about ten days to patch. For those ten days we were inundated with frightened questions from customers who were potentially exposed to data exfiltration and we couldn't do a thing for them. If you have sensitive data or trade secrets this may be an argument against cloud structure and for being in control of your own bare metal.

My constant individual user advice: go to the PUB!

PASSWORDS - change them often, with no dictionary words allowed. No storage in the clear (on the network)!
UPDATES - check operating systems, applications, firmware and processor issues regularly.
BACKUPS - check for successful and readable second copies of anything important, and store in some way unconnected to the primary network. Constant connection from primary to backup location could be a problem, allowing an attack to encrypt or erase backups in addition to originals.

The Landroid by Worx, inc. - a robotic lawn mower

Spoiler: I'm known for being critical of automation and this time will be no exception.

Full disclosure: although I use another Worx product, I have not done any hands-on examination on this line of mowers.

Only recently did I learn of the existence of automated lawn mowers - and apparently they've been around for awhile. In the process of discovering this, I've not changed my attitude about the automation of potentially dangerous devices. But I did learn much that I didn't know with just a bit of searching.

First, the forum conversation largely discusses limitations in the device capability, such as the issue of sensing short obstacles under 15 cm or 5 inches. It also (at default) uses a random algorithm like the Roomba vacuum cleaner in order to eventually cover all of its assigned area. This default can be changed with specified instructions, though this could be challenging for the mower's target audience, which is retired homeowners. [ :begin rant: Our wireless world now makes Joe Sixpack his own network administrator, meaning that many, many issues of technological maintenance will go undone... :end rant: ] And there's the possible odd appearance of random patterns cut into the grass.

But a search confirms many of my automation suspicions. In addition to onboard controls, the device is operated through phone applications and router connections. A location feature uses GPS information from cell towers to locate a lost Landroid should it stray from its assigned zone, which is delineated with a wire that must be installed at the area's edge, forming a "fence". And hackaday(dot)com reports the controller as using a "an NXP LPC1768 ARM Cortex-M3, and the debug pins are labelled on the backside. The manufacturer didn't protect the flash memory". This level of automation brings several possibilities to mind: there is already talk of some manufacturers of programmable mowers being able to restrict replacement parts to expensive proprietary ones, and of using later software to brick earlier versions. And if you don't get along with your neighbor, why not have his mower cut dirty words into the yard, bricking itself upon completion? And how much onboard memory and storage have we got? Spam server, anyone? Get your whole situation blacklisted, anyone? But the obvious issues to me would simply be that the connectivity is yet another route to the router, to be used to exploit more general vulnerabilities - and that wifi range is not properly sensed by the unit in order to avoid losing the ability to receive commands (to Work's credit, their site does note the issue and advises as to how possibly to avoid it). And the potential (haha) for coding issues and Personally Identifiable Information misuse always exists with manufacture-provided apps AND the phone companies through which such apps almost always operate.

So aside of questions of practicality (does an automated mower create more work for the user than it saves?), this appears to be yet another category of unpatched potential holes in someone's digital exposure. But it's an interesting category to investigate. From a pentesting perspective, the installation of such automated convenience devices could provide clues about the level of security overall, and about the psychology of the target user(s).

Third Week of StayCation: Different Uses For Multiple Boxes

One would be really dumb to try to do everything on one's phone: banking, insurance payments, stock trading, plotting illegal activities while assuming messaging is totally unmonitored... as if anybody ever actually did that. Oh, and doing one's taxes over a "smart"phone... that's a real winner.

But sitting at home on Covid-19 break, it occurred to me that there's enough PCs/Macs/Linux/whatever machines around here to be apportionable to many different needs. Imagine if one were to use dedicated boxes for specific risk levels or hardware needs. Let's list a few:

SECURE COMMUNICATIONS AND FINANCIAL ACCOUNTS - This would not argue for Windows XP. This would argue for a current, constantly-updated, antivirus-equipped (if applicable) latest-thing desktop or laptop. Don't load free gambling programs on this one.

CASUAL COMMUNICATIONS, SOCIAL MEDIA AND VIDEOCONFERENCING - This also argues for frequent patching and up-to-date hardware. But heavy malware scanning and general lack of trust would be important.

GAMING - High-performance hardware requirements and total lack of trust are the driving issues here.

CLONE/BACKUP OF OTHER UNIT - Mainly with the business/financial computer, if you have a crash you may need a quick replacement to step in.

OFFLINE ARCHIVING - Important files need to be stored in a safe place. This box doesn't need to be networked and you might even unplug this one when not used. And it's a good backup for a backup; the only place big enough to copy over an outboard HDD is another big drive.

FIREWALL/ROUTER/PROXY SERVER UNIT - If you have heavyweight networking requirements, a filtration point might be needed.

ODDBALL COMPATIBILITY UNIT - Particular jobs or situations could demand a particular operating system, application, application set or configuration(s). If the boss says to set it up a certain way, this is the box on which to do that.

So I've suggested that you need a minimum of SEVEN computers in your Undisclosed Location.

So? What's so strange about that? (everybody peers into my room, shakes head, walks away)

The Most Recent End Of The World

According to previous job descriptions, I have some experience in emergency operations of several kinds (I’ll keep details to myself since many of you know that stuff already and the internet already knows too much). Here’s my perspective on the current virus outbreak and how it can be somewhat managed:

1. Frequent hand-washing and refraining from touching the face are good moves. Using disposable gloves is also a good idea, as is social distancing whenever practical. Masks and buying lots of toilet paper are mistakes; the mask will not prevent a virus from getting through, but will help an infected person NOT infect someone that’s clear of the virus by containing the cough droplets. Also, intestinal problems are not present during most infections so the panic buying of toilet paper is misguided.

Edit: Information is not clear but it looks like masks could have some positive effect even if not 100% reliable, and on the toilet paper issue I've been told by a grocer that most of the cheap TP comes from China, where supply chain disruption has happened. So not all the TP went away from hoarding, and masks could be a good thing even in less effective contexts.

2. Many people appear to be buying more groceries than usual, perhaps since they’re not going to restaurants and bars so much. From what I’ve seen, the supply chain for produce and other foods is functioning well, but still needs overnight restocking. This is an opportunity for those of us that have earthquake kits (on the West coast), tornado kits (in the Great Plains) and hurricane kits (East coast and gulf coast) to restock and discard out-of-date canned goods, expired and leaking batteries and so forth. And in many areas take-out service or drive-through is still done at coffee houses and restaurants. And it may be a first that Texas restaurants are allowed to deliver alcoholic beverages with food orders, a measure not previously allowed in that US state.

3. Although much of the economy is being upset, many things still function. Power systems and telephone/internet transmission is good. Fuel oil, diesel and gasoline supplies are plentiful. Car repair places are still doing good business where I am (central US). The medicine I need is easy to get. Water/sewer service is unimpeded. And the weather has been mild. It could be worse.

4. The internet is rising to the occasion with not only new resource pages, but with the ones that already existed such as www.cdc.gov and www.ready.gov at least for the US.

5. Finally, remember that corona-family virii have been around for some time, and the infectious disease experts have been to this rodeo before (I think about ten times in the last 25 years or so for the US). If recent Chinese reports are accurate, the Hunan area is seeing a drop in need for bed space, treatment, therapeutic medicine and so forth, suggesting that the curve is already headed down at their locations. And early fast-spread statistics from Italy are something that I think could be explained by the close-in conversation habit that Italians consider normal. This effect would not apply to most other societies and I’ve seen at least one report that suggests that the Italians now are doing better than other European countries at social distancing practices.

I invent a new acronym...

... mainly for my own convenience: ITNA - Individually Targeted National Attack.

Here's a good Forbes Magazine article about the most recent developments in what we used to call 'wardriving'.

Driveby Vulnerability story

And here's one of the latest things on the Huawei issues.

Huawei story

At the risk of repeating myself, I'll speculate on the global possibilities of such hyper-local matters. One of the exposures of the Imperial Japanese Navy in attempting to knock out the American Pacific fleet in 1941 was the possibility that they'd be discovered as they slogged their way from Japan to Midway. They got discovered, thereby failing in their efforts. What if that trip had been unnecessary?

The whole "digital Pearl Harbor" scenario posits the internet as a remote access point to sensitive areas that an enemy would wish to use as attack vectors. Put that idea together with such things as personal data leaks and you get the possibility of attacking an enemy nation via bypassing national defense infrastructure. The Russians have already approached this by trying a cyberattack on Ukraine's municipal power grid some time ago. If citizens can be attacked directly, then there's little need for near-Napoleonic Era infantry advances. Observe this list of aspects of an individual's digital life:

Phone GPS tracking and phone company cloud data backups/saves

Smart home connections from digital assistants to smart light bulbs with insecure protocols

Financial information in data leaks

Medical information in data leaks

Email accounts, particularly free webmail

Government (national, state and local) information in data leaks

Information publicly viewable from government or Google

Resume information posted to job sites or on personal pages



First, set up a data collection project to track every citizen in the target country - let's say around 100 million people. Every citizen has a file. That file would become a dossier to use to feed an attack script specific to the person. The script could have sections for dox-ing personal contact info, for shutting down phone numbers and accounts with a phony email claiming a move to a competitor, for making unauthorized purchases that could trigger auto-shutdowns of credit, for making false police calls... get the idea?

Add those custom measures to the obvious things like attacks on police dispatch communications, remote traffic control systems, computer-controlled telephone exchanges, food distribution networks, internet-accessible remote starting in recently built cars and trucks... and all the other new exposures or vulnerabilities that have arisen over the last ten to fifteen years. And the Stuxnet worm has shown everyone that (with access to certain programs and languages) it's possible to destroy industrial devices with instructions inserted into the control points from outside.

So Country A could attack the 100 million citizens of Country B after first building the citizen files, then getting the attack scripts finished, then populating the attack script with info on the target citizen. After that, it's an access question (perhaps constructing backdoors over time) and then one simply selects a time to pull the trigger. No armies or navies needed. It's a software development project with a very large database. That sort of thing is done every day; it's just been weaponized by someone in this example.

How to protect oneself? If I were the government, I'd pull back on commercial off-the-shelf solutions and use more home-grown ideas, plus put more people onto network monitoring jobs. Individuals would benefit from my "Go to the PUB" advice: maintain Passwords, Updates and Backups. And don't load gobs of free apps onto your phone without knowing who they talk to.