InfoSecurity Europe 2011

InfoSecurity Europe is over for another year. Once again there were several interesting companies and sessions worth noting. The 'themes' (if they can be called that) or 'hot topics' were cloud security again, social media and mobile access/the consumerisation of IT. The big difference seemed to be in the attitudes of people - more 'how can we reduce the risks to an acceptable level?' rather than 'we can't secure it, so we won't allow it!'

We are seeing a shift in the types of systems end users are accessing the corporate network from. The IT department are no longer dictating what will or will not be allowed. More and more users want to use their own personal devices, such as iPhones or iPads, on the network. In the past IT departments have resisted this and said no to the users. However, this attitude is beginning to change and there were a raft of organisations with solutions to help secure these devices and manage the data they contain. However, an awareness of risk and what it means to consumer devices and ownership must be understood beforehand.

With cloud security a big issue, and still stopping some organisations from adopting cloud services, I decided to speak to some of the cloud services providers about their security. Many of them couldn't give me the real technical details, but some of them did have some reassuring things to say. Unfortunately, not all services are equal and organisations are still going to have to do a lot of research on the providers and make sure that they ask to see independant reports on the security of any potential provider. Make sure you ask them the difficult technical questions and only use their service if you are happy with their answers. Again, always remember that you can't outsource risk, so think carefully about what you want to use the cloud for.

Social media is still an issue that some organisations are solving by blocking it and others are ignoring. With the latest generation of products, again we can be quite granular with the level of access granted to social media, so a default blocking isn't necessary in all circumstances. The (ISC)² have conducted a very interesting survey on security that shows some interesting trends, not least of which is that 49% of organisations block Facebook and around 20% don't monitor social networks at all. As social engineering and backdoors through user activity are some of the main causes of problems, this is worrying. Indeed, the survey showed that security professionals put education and policy mechanisms as the top 6 security security solutions required, with software and technologies coming in 7th and 8th respectively.

Base64 Encoding is NOT Cryptography

I have once again come across an IT department who were/are firmly convinced that the commercial web application that they use is secure and has encrypted user details. What it actually does is Base64 encode the password. This is not encryption and must be treated as plaintext.

So what is Base64 encoding and why do we have it? Well, a large number of popular application layer protocols are ASCII text based, i.e. they transfer plain text over the network. A good example of this is HTTP - the protocol used to transfer HTML (or Web) pages around. Originally, only text pages were sent with markup embedded to style it. However, soon other resources were added to the web including pictures, documents, etc. HTTP is designed to transfer plain ASCII text, so how do you transfer a JPEG photograph? Answer: You convert it into plain ASCII text.

The basic principle of converting a file into text is to use the data to represent an index to the ASCII character, e.g. 'A' is 63, 'B' is 64, 'a' is 97, '8' is 56, etc. So, if the first four bytes of your file are 63, 64, 97 and 56, this can be represented by 'ABa8' without loss. However, ASCII is actually only 7 bits and we usually use 8-bit bytes (because of IBM setting the standard - actually a byte was historically just the number of bits required to store a character). Also, ASCII character 13 is a carriage return, 27 is escape and 8 is backspace. These are non-printable and, worse than that, could corrupt the communications as well as remove other characters. So, we can't just do a straight conversion from bytes to ASCII.

This is where Base64 conversion comes in. We split the file up into 6-bit 'bytes', rather than 8-bit. 6 bits give us 64 possible values. These are then represented by the digits, upper and lowercase letters and a couple of symbols ensuring that they are always printable and don't cause problems. So, the Base64 encoded password is just a 6-bit 'byte' representation of an 8-bit byte password and it is trivial to convert between the two. There is no security in Base64 encoding anything. Perhaps I should repeat that again.

Base64 encoding something is not encrypting it and provides NO SECURITY whatsoever!

I am constantly surprised and disappointed that people think that Base64 encoding something will protect it. I know TLS has its problems, but why aren't all web applications using it?

The little JavaScript tool below will allow you to encode and decode Base64 encoded text to see what it's like and how simple it is. If you find Base64 encoded passwords on your network via sniffing then you can use this to decode them.

Enter Text:


Select Encoding or Decoding:

Encode | Decode

Security Risk is Proportional to Hacker's Skill

There are many factors that influence the risk to your organisation and they are by no means all about hackers. However, we do have to deal with hackers and have to realise that they are a fact of life that won't ever go away. So how much risk are we at from hackers?

The truth of the matter is that the risk your organisation faces from hackers is proportional to the skill of the hacker. There are many different types of hacker, from the person who downloads a free tool, through script kiddies to highly intelligent, technically skilled people who can discover and exploit any vulnerabilities you may have.

The tricky thing is to figure out who you will likely get attacked by. Many organisations have the attitude that they are not a natural target so nobody will attack them and they don't need to worry about security. Unfortunately that just isn't true. Computers are very good at doing repetitive tasks without getting bored. As a test we have standard ADSL line with a web server sitting on it, which is completely non-advertised, yet it gets attacked 4 times a day on average. The problem is that if you have simple vulnerabilities or use the same components and services as others that are targets then they could be discovered on your network and exploited by simple to use tools. The problem is that the exploits are created and distributed in freely downloadable tools for all to use.

It is relatively easy for a hacker to find and exploit your system even if you aren't an obvious target.

True Random Numbers from Random.org

Much of security relies on randomness - encryption keys should be random and random passwords are more secure than dictionary words or predictable sequences. The problem is, how do we generate a random number?

Well, actually, this is a trick question. The answer is that you can't generate random numbers, but you can observe them. Most programming languages give you a random number generator, so why not just use that? Well, it's not actually a random number generator, but a Pseudo-Random Number Generator (PRNG), or more accurately a Pseudo-Random Sequence Generator (PRSG). Given the same seed value, it will produce the same output every time. Try seeding the random number function in your favourite programming language then run your program a few times. You should see the same numbers coming out each time.

The reason for this is the function used to produce random numbers is just a mathematical formula that takes an input and gives an output. To have a random number out, you need a random starting value. Most will seed themselves on the clock, but this isn't random; it isn't even unpredictable. A simplistic example of a PRNG, as given by Knuth in his seminal books, is as follows:

X = (a*X+c) mod m

Random number = X/m for some suitable large prime number m and fixed values a and c both less than m (indeed c is usually a small number <10).

This can be seeded by setting X to the seed value and will give the same sequence of pseudo-random numbers out, as can be seen. However, it isn't random. If I know your seed value I can recreate your sequence of numbers. If you seed it on the clock it is often possible to work out a window of opportunity and obtain a range of seed values. Admittedly, this could be large, but an exhaustive search of these would be quicker than breaking the code that relies on them in many cases. Recently, a large Linux distribution was found to have a flaw in its key-generation that introduced a major weakness into the RSA public-key codes generated on those machines. This was due to predictability of the keys and a lack of randomness.

So, what can we do? We can observe randomness in the natural world. Random.org uses background white noise as a source of randomness. This gives good randomness and distribution of numbers. They offer several options to generate random numbers, sequences or even passwords. An example of their random number service is given below. I'm not saying that they are the best option or the only option, but you must use truly random numbers in your cryptography and secure systems.

HDD Tools & Other Malware Removal

Recently I had someone come to me with their laptop saying that they had a new anti-virus program that they didn't remember installing and that 'other things' on their laptop didn't seem to work any more. The same thing happened to a corporate desktop machine I was asked about a couple of weeks later, that was originally running McAfee. Finally, two days ago I saw another corporate machine running McAfee that was saying that it had a hard drive failure. A tool, called HDD Tools, then automatically ran to diagnose the problem and stated that if they purchased the full HDD Tools product then it could fix the problem.

Each of these was a piece of malware that had infected the machine and was trying to get the user to enter their credit card details into a website so that money can be taken from their account and maybe their card cloned. These malware programs go along with the fake anti-virus software that the APWG have reported a huge rise in recently. These are a collection of programs that purport to be useful software and will fix a problem that you are experiencing. The truth of the matter is that it is that software that is causing you the problems in the first place and paying them the money will just cause more trouble.

The later breed of scams using these supposedly useful tools do one of two things in general - either they cost you money and they may try to clone your card, or they will enlist your machine in a botnet. For a discussion of this type of malware and its proliferation, see this blog post.

Here I wanted to tell you a couple if simple steps to remove this type of software if you do get infected. Obviously, it should go without saying that you should do everything possible to try to avoid getting infected in the first place rather than try to recover from it - the damage may already be done. However, there are many similarities between them and you will need to remove them. A simple procedure can often work to get rid if them as follows (N.B. this will not always work and if you make a mistake you can make things much worse).

1. Detect that you have rogue software (malware) on your system. This isn't always hard as, in the case of HDD Tools, it will keep popping its window up and not allow you access to the C:\ drive of your computer. Other things to look for are if your AV product doesn't work or if you get strange services appearing in the Task Manager. Often the malware will stop Task Manager from running by disabling the Run command and the right-click functionality on the Taskbar. However, sometimes you can still get access to it by pressing Ctrl+Shift+Esc. Look for processes with random names; HDD Tools uses a number like 20418112.exe, that will change with each infected machine.
2. Reboot your machine in Safe Mode by pressing F8 during boot (that's the function key F8, NOT press the F key then the 8 key). If your machine boots up normally then you didn't press F8 early enough - you need to reboot again. You need to go into Safe Mode as the malware will prevent you from deleting it normally by having a background service running. This will not be started in Safe Mode, so you can remove it.
3. Once in Safe Mode, you can begin to remove the malware. First, you need to find out what the malware is and where it's stored. Mostly the malware won't appear in the list of installed programs so can't simply be uninstalled, but that's worth a check. However, sometimes this can be used to reinfect the machine, so be wary. If you have rogue software on your system then it will probably have created some kind of shortcut on the desktop or in the Start menu to make it seem legitimate. Have a look at where this points to and what the name of the file is. Other places to look are in the Startup folder and in the list of services installed on the machine. In the case of HDD Tools, it installs a desktop icon and Start menu folder.
4. Navigate to the path in Windows Explorer to find all the files you are looking to remove, but don't remove them yet. HDD Tools stores its files in your temporary folder, e.g. C:\Documents and Settings\username\AppData\Local Settings\temp, or C:\users\username\AppData\Local\temp. You may need to show hidden files and folders to be able to see this folder in Windows Explorer by changing the settings in Folder Options.
5. Run a file search on your machine to see if there are any other instances of those files anywhere else for you to remove.
6. Run Regedit from the Run... command to open up the registry editor (Warning: messing around with the registry can ruin your machine). Now run a search for the filename in the registry.
7. You will need to go through the registry to remove all references to the malware and any keys that it has created. In general, if the only entries in the key relate to the malware you can remove the key, otherwise just remove the values. These often appear in HKEY_LOCAL_MACHINE or HKEY_CURRENT _USER in the Software\Microsoft\Windows\CurrentVersion key.
8. Once you have deleted these, you can go back and delete the original files.
9. Reboot normally and check your machine.

It is still possible to get infected even if you have a properly managed device with Anti-virus software installed. The problem is that they are not 100% effective. See 'How secure is your AV Product?'

McAfee Secure Short-URL Service Easy to Foil

McAfee have launched a Beta URL shortening service with added security features. As Brett Hardin pointed out they are a little late to the game. However, there are so many abuses of URL shortening services that I commend them for trying.

Basically, what their service does is allow you to create short easy URLs (like any other service). However, unlike other services, when you click on the link, it opens a frames page with the content in the bottom frame and the McAfee information in the top frame. This information includes details about the domain you are connecting to, the type of company it's registered to and a big green tick or red cross to tell you whether the site is safe or not. This is decided by their 'Global Threat Intelligence', which will block known bad URLs and phishing sites. That's good, if it works.

I said above that I commend them for trying to provide this service. There are some obvious failings in their solution though, that render their protections useless other than to make it easier for people to phish users as the page has the McAfee stamp of approval. Below is their site working properly to block a known bad phishing URL.


As you can see, this site was blocked and marked as a phishing URL, which it was. Excellent, it's working! Hold on a minute though. Have a look at the screenshot below where I can access the same URL through their service by embedding it in an iframe. I now get the big green tick and I'm told that it is safe. You can see from the source that the iframe is showing the exact same URL as was blocked before. Incidentally, the page says that the site is a Business Internet Services company, which is extremely misleading as I can assure you that this wasn't put on a domain run by a Business Internet Services company.


Also, what about if I code my page to not accept being in a frames page? Then the service falls down again. The screenshot below is of Twitter accessed through this service. The problem is that I can hide all sorts of other links in the page to fool McAfee and the user won't see them. I know McAfee will block these URLs in time, but they will only be blocking the host page and they will have to block all of them. Also, if you click on a link within the page that directs you to another domain, then that is not checked, so I could just redirect you to a phishing URL and you'll still get the big green tick.


It's a nice idea, but it just doesn't work. Interestingly, other services also have some security in them. TinyURL, for example, wouldn't allow me to create a short URL for this phishing site in the first place as it was recognised as such. McAfee happily let me produce the short URL, they just blocked it later - not such a good strategy in my opinion. I know that a new phishing URL would fool TinyURL as well, but I particularly chose a URL that had been around for the best part of a month to give them a chance and I think TinyURL has done better. Incidentally, TinyURL also allowed me to produce a short URL for my test page. One good thing about TinyURL is the preview facility, but that doesn't protect me against a site that looks like the real thing.

Moral: follow any links at your own risk and don't think that a green tick makes it safe!

IPICS 2010 Network Security Slides

My slides on Network Security and Steganography, presented at the Intensive Programme on Information and Communication Security (IPICS) 2010 can be downloaded below. The topics covered under Network Security are: Access COntrol Devices, Firewalls, Network Protection, Network Authentication Protocols, TLS, VPNs & Remote Access. The Steganography slides cover examples of: Image, Network, HTTP and Twitter Steganography.

A PDF of the Network Security slides can be downloaded from here.

A PDF of the Steganography slides can be downloaded from here.