Next Generation Malware – STUXNET

A news item that keeps bubbling up in the information security world is about STUXNET, a malicious piece of software that was originally said to target nuclear reactors in Iran. This might seem a bit odd, as most malicious software is pretty random, infecting anything it comes across. This malware seems to have had a very particular purpose.

It has been well known since its discovery that STUXNET targeted SCADA (Supervisor Control and Data Acquisition) systems, which are used in industrial process control environments, essentially providing electro-mechanical control over a logical network, be that the Internet or via a dial-up modem. SCADA systems are used all over the place, controlling sluice gates, traffic lights and in nuclear reactors. In general, these systems are kept as far away from public networks as possible, to prevent the infection of the networks they reside on, as the results can often be catastrophic.

However, an article in The Register, referencing a Symantec blog, detailed that this malware was even more specifically targeted. In summary, the article explains how STUXNET was aimed at frequency converter drives made by Fararo Paya of Iran and Vacon of Finland, both, presumably, used in the Iranian nuclear programme. Not only that, but only those drives that operate at very high speeds, between 807 Hz and 1210 Hz. It also had the capability to spread via USB sticks, thereby not being dependent on an accessible process control network.

The code reveals that the malware would change the output of the drives, intermittently, over a period of months, thereby disrupting whatever they were controlling, albeit subtly. Interestingly, this type of equipment has export restrictions placed on it by the US as they can be used in the centrifuges that enrich uranium.

One has to assume that the purpose of the malware was to sabotage the Iranian uranium enrichment programme in such a way as to not be discovered.

The reason it got discovered was that it was too successful. Tens of thousands of systems across the world have been infected by STUXNET, notably in Indonesia.

Given the level of targeting and pre-requisite knowledge of uranium enrichment, was this written by the regular clan of virus writers, whose main aim is quick profit? Unlikely.

Staying Safe Online awareness series at LSE

The majority of people I talk to want to do the right things online to protect themselves but don’t know what to do. That said, most people won’t go hunting for information to help themselves because they have to wade through great mountains of jargon and impenetrable comments from all quarters. If they do go looking for stuff, many give up.

So, I have been organising a series of three evenings at LSE, in the Old Theatre, with eminent speakers to explain what’s going on in the information security world, and how you can protect yourselves.

These will take place on the 19^th, 20^th and 21^st of October from 6.30pm and are open to the general public.

#ssol on Twitter

On the Internet nothing is ever deleted

This case just goes to show that you really should never post anything online you don’t want the world to see.

In summary, a woman in the US has been claiming that she is largely bed-ridden. The company that she works for disputes this, citing pictures of her being active on her Facebook account and they have applied to a judge to gain access to her Facebook and MySpace postings, including those that she has deleted.

It’s not overly clear from the article whether deleted posts were actually recovered, but Facebook’s privacy policy implies that at least some deleted content can be recovered.

More analysis can be found from The Register.

Webamil insecurity

There are reports today that Google is considering quitting China after many Gmail accounts were hacked, belonging to human rights activists, both inside and outside China, apparently by the Chinese government. This poses an interesting question: how many people using Gmail or any other free, web-based mail system, are sending and receiving information that they consider confidential, with little or no idea about whether their accounts are secure.

You get what you pay for
It’s true: if you don’t pay for a service, why should you have any expectation that the provider is under any obligation to you? If you look at Microsoft’s “Terms of Service” for Hotmail, it clearly states that it provides no warranties for the service. In addition, the content may be stored pretty much anywhere in the world. So, how can people assess the risk of storing confidential information in these systems?

Auto forwarding mail
I have also come across people who automatically forward all of their work emails to an external Gmail or Hotmail account as they find it easier to use than the company-provided mail system. It might have more features; have a prettier user interface; whatever… However, this could potentially create a serious headache for the company or organisation concerned. Authentication to web-based mail systems is usually weaker, employing simple password-reset routines, where people can set their own questions (I saw one who had written, as his secret question “What is Captain Kirk’s middle name”. Not exactly the hardest thing to find out).
People routinely using webmail for very sensitive information, where the implications of disclosure include risks to people’s lives, should really reconsider whether using something like Gmail, Yahoo mail or Hotmail is a good idea in the first place.

There are a few solutions. Stick to your company’s mail system and consider using encryption, or try to use encrypted mail with webmail accounts. Encryption brings a whole new raft of issues I won’t go into here, but some companies already provide an integrated, but paid for, service to do this, like Hushmail.

But never forward email out of a company automatically to an external source without checking with your IT department first – there may be many more serious implications than you might realise.

Hacking Facebook

I just got pointed towards an article that shows that your Facebook account password is worth $100. It’s impossible to tell whether this is genuine or not without sending $100 via Western Union to the Ukraine (and what is it about Western Union and scams??) but it does raise some interesting questions about how much people would be willing to pay to hack into someone else’s account. I have had people come to me with this same issue and it’s really difficult to regain control – it is a free service, after all.

More on this soon…

Digital Certificates

Lots of people have been discussing digital certificates with me lately, with several certificates having to be re-issued due to certificate chain problems. I thought I’d take the time to explain how these things work in simple terms.

Most people come into contact with certificates when either setting up a web server that uses SSL (Secure Sockets Layer) to encrypt data in transit or encrypted e-mail. The two main functions of a certificate are to provide encryption using the keys contained with them and provide assurance that the owner of the certificate is who they say they are. Certificates issued inside an organisation for solely internal use, the second point might not be so important as assurance can be gained through talking to the person who issued the certificate. However, under most circumstances, people need independent assurance that the owner is who they say they are.

Certificate Authorities

A request can be made to have a certificate digitally signed by an independent organisation (certificate authority) which people already trust, making the process of accepting a certificate as valid seamless. However, how does an end user trust the certificate authority? Surely, we still have the same problem in providing identity assurance with these organisations, otherwise we wouldn’t be able trust their digital signatures? This has, in the most part, been solved by pre-installing the certificates of these organisations into applications like e-mail clients and web browsers that are likely to come across these signatures. If you want to take a look to see who you trust by default, try going into Tools -> Internet Options -> Content and click on the “Certificates…” button. One of the tabs across the top will be labelled “Trusted Root Certification Authorities”. In Firefox in Windows, simply go to Tools -> Options -> Advanced -> Encryption (on a Mac, just go to Preferences -> Advanced -> Encryption) and click on the “View Certificates” button. One of the tabs will be entitled “Authorities”. Different browsers and e-mail clients will have similar options.

The reason that these authorities are trusted is because they have stringent verification methods to ensure that certificates are only issued to the correct people or organisations.

However, there is a problem with this model, one which manifested itself at LSE, where a root Certification Authority changes its signing key and certificate pair to one that is not already present in all browsers or clients. The only way to automatically trust certificates signed with the Certificate Authority’s new key is to manually install it, which is not recommended. Apart from the obvious danger that the person doing the installing has to do equivalent checks on the identity of the certificate to provide the same level of assurance as the other certificates in the root Certificate Authority list, having to get every client that may connect to that device is a nightmare.

It is by far safer to have certificates signed by a key that is already in the client. This is why most Certificate Authority’s certificates have very long lifetimes, equivalent to the expected lifetime of the equipment of the client, to prevent manual updates.

The point of all this is that the client doesn’t need to refer back to the root Certificate Authority every time it comes across a certificate signed by that particular CA. Nor do they even, necessarily, require a route back to the CA at any point, as long as the CA’s credentials are held locally.

Expiry and revocation

Certificates all have an expiry date. It is assumed that the “private key” (that which is used to decrypt information or digitally sign other messages/certificates) will get compromised at some point. The more protection given to a certificate, the less likely it will be compromised and, therefore, the safer those certificates dependent on it will be. This paper describes the ways in which an organisation might protect its own certificate signing key.

If a private key does get compromised, it is possible (albeit hard) to revoke that certificate and any child certificates using a certificate revocation list (CRL) that is incorporated into the certificate itself. This process is, however, a bit flakey, as it defeats the purpose of being able to do offline verification of certificates based on locally-held, trusted credentials of CAs.

The Twelve Scams of Christmas

I know I’m a bit late getting to this topic (Philip Virgo got there first) but I think it’s worth blogging about this, too. Here is the only (?) Christmas carol to be adapted for information security:

The Twelve Scams of Christmas

Twelve Phishers phishing
Eleven Spammers spamming
Ten Bots a’ herding
Nine Virus writers coding
Eight Snoopers snooping
Seven Worms a’ spreading
Six Crackers cracking
Five Tro-jan Horses
Four Logic bombs
Three Software patches
Two Denials of Service
And a hacker at your back door!

Credits go to Philip Virgo, Margaret Smith (plus the other ISAF members) and the countless members of IT Services at LSE who had to endure this being actually sung to the music of “Twelve Days of Christmas”.

The links go to GetSafeOnline. For more information, see the links on the right. I’ll blog on each topic over the next few days.

Encryption issues

Many people ask me about the issues surrounding encrypted devices and whether they can (or should) encrypt data. So, to clear up any confusion, here’s my take on this issue.

First point: Encrypting data, especially on removable devices, is a good idea

Given recent events relating to the loss of sensitive data (like, the loss of nursery data on a USB stick, Government user IDs stolen from a parked car, the banks losing customer data, Number 10 staff losing their Blackberry’s in China… This list is endless), it is blindingly obvious that some form of protection for data while not stored in a physically secure environment is needed. The losses actually reported are dwarfed by those that companies elect not to report. There is a great debate going on about whether companies should be compelled to report these sort of breaches under Data Protection legislation, as currently most organisations don’t have to.

In addition, individuals should ensure that their own data is adequately secured. It’s not just companies that have this problem. How many people store their passwords to their online banking on their laptops and then carry them around with them all over the place? And, given that most operating systems have built in encryption capabilities these days (Microsoft Windows XP and Vista do, as does Mac OS X), people should really consider turning these on.

Second point: There are lots of different applications for encryption

There’s device encryption, full disk encryption, e-mail encryption, SSL encryption for websites and other types of traffic, VPNs… Plenty of different applications for very different purposes. And managing this becomes a bit of headache…

Third point: In an organisation, it’s not that simple…

Having said all of the above, it would easy (but wrong) to assume that it’s very simple to implement encryption in an organisation. It isn’t. There are three choices: 1. Implement stand alone encryption for everyone who needs it, using a variety of different standards and without the capability to access these in the event of a disclosure requirement; 2. Implement an integrated encryption service, managing people’s keys centrally (or at least having an administrative key for access in the event of a disclosure requirement), or; 3. Take the risk and don’t do anything.

The trouble with option 1 is that the organisation is liable for everything that gets sent or stored from or on its systems. In the event that a request to disclose some information stored in an encrypted file or e-mail is made by the authorities, it is essential that, given the right safeguards, an organisation can access that data. If everything is set up in a standalone fashion, this becomes difficult.

Option 2, therefore, looks much more attractive, but it does come at a cost, both in terms of infrastructure and management. Many organisations opt for option 1, but ensure that each user of encryption software sign a disclosure agreement that warrants their co-operation in the event the organisation is requested for data held in a system that they, themselves, control.

Finally, option 3. I would not recommend going down this route. The Information Commissioner seems to be blowing hot and cold over the absolute requirement for device encryption, but it looks likely that principle 7 of the Data Protection Act 1998 will be breached if laptops and other personal data aren’t encrypted.

Fourth point: Travelling with encrypted files

This may come as a bit of a surprise, but different countries have wildly different laws about encryption, so it is essential that people check out what the legislation is in the country that they are travelling to, in case they are accused of espionage activities (I’m not kidding!). For a comprehensive overview, the University of Tilburg, in the Netherlands, is hosting a page on the Wassenaar Arrangement. This details how different countries license the export and import of different levels of military materials. To quote:

“The Wassenaar Arrangement controls the export of weapons and of dual-use goods, that is, goods that can be used both for a military and for a civil purpose; cryptography is such a dual-use good.”

As an example, I’ve picked Russia. It states: “A license is required for the importation of encryption facilities manufactured abroad. The export of cryptography is subjected to a tightened state control. Importers and exporters need licenses by the Ministry of Trade.”

I am not a lawyer, and I suggest getting legal advice rather than ever relying on something you’ve read in a blog.

More information:

Surfing Safer: Advice on choosing encryption products

Laptop encryption in Russia, China

20 Years of Worms, Viruses, Trojans…..

It may come as a bit of a surprise that the first piece of malware to use the Internet to spread was released into the wild in 1988. The “Morris Worm” was written by Robert Tappan Morris, then a student at Cornell University in the US and who, embarrassingly, was the son of Robert Morris, the former Chief Scientist at the US’s National Security Agency (NSA). His worm infected roughly 10% of all systems connected to the Internet at that time (bearing in mind that in 1988, the Internet had a grand total of 60,000 connections; today, this figure lies somewhere around 1.1 billion) and still holds the record for the largest percentage infection of the Internet.

Why is this relevant?

The explosion in the numbers of devices connected to the Internet has resulted in an explosion in the number of programs designed to compromise the devices connected to it. Ever since people started using the Internet, others have been trying to subvert them. It’s an ongoing battle and anti-virus companies have been making large sums of money by trying to protect people from them. Sophos recently reported that they are receiving 20,000 new samples of malware every single day. And it’s not the traditional e-mail attachment, promising titillating pictures of the latest B-list celeb, either; in the same report, Sophos say that they see over 16,000 new website infections every day. This means that simply by looking at a website, often from a genuine and reputable company, a machine can be infected without any interaction from the user.

It’s not about fame anymore

In the good old days of virus writing, authors would write something that would throw up messages, immediately telling the user of the machine that they were infected. Some examples can be found on F-Secure’s virus screenshot archive. These days, however, the whole malware space has become much darker. Viruses, worms and Trojans no longer advertise their presence but rather attempt to lurk on a users PC without their knowledge, quietly subverting the machine.

Why the shift in MO? Simple: Money.

These days, most malware is written to infect machines in order to take control of them. These “zombie” machines are then part of a “botnet”, controlled by a “bot herder”, who sells time on his/her botnet to the highest bidder. Essentially, these zombie machines can be used to do anything. The faster the machine and faster the Internet connection, the better. They can be used to launch “Distributed Denial of Service” attacks, where vast amounts of junk data are thrown at a particular company or website, with the intention of taking them off the net as part of an extortion exercise, or for the storage of porn. Far worse is the ability for paedophiles to store their collections on the infected PCs of unsuspecting users, allowing them to keep distance between themselves and their images.

Storm

The largest of these botnets that has been found to date is known as “Storm“. According to some sources, up to 50,000,000 devices are zombies were part of Storm in September 2007. It has been reported that the bot herders running Storm were making profits of $9,600 daily, with spam being the main revenue generator.

What can I do?

Really, it comes down to ensuring your anti-virus is up to date (and this includes Mac and Linux users! I’ll come on to why in another posting), ensuring your firewall is enabled and patch, patch, patch! I have been made aware of a free tool to tell you which programs installed on your PC need patching, and not just those written by Microsoft. Potentially any vulnerable component could be used to crack open the machine and zombiefy it. I really recommend downloading this application and updating those things it finds.

Social Networking Risks – Facebook and others

With the rise and rise of social networking sites, everyone is getting online and publishing more stuff about their own lives. But not everyone is fully aware of the risks that they run by putting so much information about themselves online.

The Internet never forgets

Many people don’t realise that when something gets published, it is very hard to take it off the Internet. Consider this when publishing photos from the last time you had an all-night, booze-fuelled party. A number of sites offer historical archives of the web. Google offers up cached versions of web pages in its results. Historical data has caused all sorts of problems a number of companies, most recently United Airlines. Other stories keep resurfacing. The BBC and Microsoft have an ongoing issue with a story written in 2001 about Hotmail considering charging users for its e-mail service. The story (from 2006) is here.

Employers will search the web for you

Many employers will now search the web for any information they can find out about you before you get offered a job and, in some cases, will take issue with things that you post online while working for them. Here are some examples:

Policeman loses job opportunity because of his Facebook profile

Waterstones employee loses job because of blog comments

Australian man found lying about sickness through Facebook

Virgin and BA staff sacked for Facebook site criticising customers and their respective companies

And if you think you can simply delete your Facebook profile, think again. It is seemingly very difficult to actually erase yourself. While deactivating your account is simple enough, actually getting Facebook to delete your details is much harder. This has been the subject of concern by the Information Commissioner and he discusses it on this BBC page.

Watch out for the actions of others

If you do post something on your profile beware what others may do with that information. There has been a tragic case recently of a woman who was murdered by her husband, simply because she had changed her relationship status on her profile.

It’s not all bad

There are ways that you can limit the risks you run by using social networking sites:

Always think about what you upload: consider what that picture of you on the drunken night out might look like to a future employer.

Don’t post everything about yourself: a date of birth is essential for an identity thief – do you really need it on your profile?

Check the privacy settings: most sites, like Facebook, allow you to restrict who has access to what information.

Search online every so often to see what’s published about you: it’s always a good idea to see what information is available about you online.

Don’t install every Facebook app: some have been found to be malicious

Only invite friends that you know: if you don’t know them in person, think hard before accepting that friend request. They may be impersonating someone else.

There are sites that can help. Sophos do a really good guide to Facebook settings, there’s an online video about MySpace privacy settings from SafetyClicks, and Bebo themselves have published an online safety guide.

But these settings will not protect you if you’re either blogging directly, have your own website or use another service. Fundamentally, the question you have to ask yourself is: should this information be online at all.