President of Colombia Has Swine Flu and So Might Other Leaders

This article pointed out the recent diagnosis of President Alvaro Uribe, of Colombia, with swine flu. Even worse, the leaders of Colombia have alerted the other leaders that were involved in a regional South American summit last week. While President Uribe is not considered high risk for death from the disease, this is a new turn in the pandemic and public awareness. To date, Colombia has reported 621 cases with 34 deaths, making the mortality rate .05%.

Meanwhile, in the US and UK, school has just resumed and health officials are closely monitoring schools. Plans for handling outbreaks in the schools vary by district, but several are known to be testing plans for tele-education and remote teaching.

Once again, organizations are urged to undertake some form of pandemic planning and testing, as a “just in case” measure for H1N1 and the possibility of a strong flu season this year. SANS has just launched a site dedicated to pandemic planning and news. Check it out for more information, or give us a call and arrange a time to chat.

Flu Pandemic Begins Early in Japan and Could Accellerate US Season

According to this article, just published, the flu season has unexpectedly begun early in Japan.

The WHO has fears that this outbreak could also hasten the beginning of flu season here in the US. This puts additional pressure on the health systems to prepare for vaccinations and on the producers of the vaccines to push forward as quickly as possible.

As we have previously mentioned, it is a good idea for organizations to prepare a pandemic plan to handle outages of staff or remote working arrangements in preparation for the H1N1 flu and other natural emergencies of similar scope. Please, take the time to review your plans, test them effectively or create these plans as soon as practical.

Keep an eye on the WHO and CDC news channels to stay abreast of flu trends and any patterns or new developments. Here are links to their sites.

WHO and the CDC sites.

Thanks for reading!

When The System Works, It Really Works! :)

OK gang, so here is our part of the story.

As many of you may now know, the NCUA issued a fraud alert this week based on a social engineering test we were doing for a client natural person Credit Union. You can find some of the materials at the following URLS:

NCUA Media Release

SANS Storm Center


Once we saw the alert from the NCUA, we immediately contacted our Credit Union client about the situation. The client had received the letter and CD set in the mail, just as intended and called for in their testing agreement. However, on their side, the person responsible for the penetration test was out the day the letter arrived. The receiver of the letter followed their incident response process and reported the suspicious activity to the NCUA Fraud Hotline, just as they are supposed to do.

Upon our contact with the CU, the entire situation became apparent and we quickly identified how the process had proceeded. The employee of the CU had followed the process, just as they should, and alerted the proper authorities to the potential for fraud. We immediately contacted the NCUA Fraud hotline and explained that the process was a part of a standard penetration test. Eventually, we talked with executive management of NCUA and offered them any information they desired, including the source code to the tools on the CDs. The NCUA was wonderful to work with, understood the situation and seemed appreciative of our efforts to help ensure that their members were meeting the requirements of NCUA 748, which calls for the protection of member data against illicit access, including social engineering attacks like these.

During our discussion with NCUA executive management, we discussed me reaching out to SANS and such to clarify the situation and to explain that the “attack” was simply a part of a penetration test. I did this as soon as I hung up the phone with NCUA. The handlers at SANS and I traded emails and phone calls and they amended their release to include the penetration testing scenario. The whole point of this was to add clarification and to prevent people from getting “spun up”, since there really was no ongoing attack in progress.

However, in typical Internet fashion, the story had already taken on a life of it’s own. The next thing we know, the press is picking up the story, there’s an article on slashdot and people are in alert mode. We then set about trying to calm folks down and such on Twitter, through email and such.

The bottom line here is this. This was a controlled exercise in which the process worked. The social engineering attack itself was unsuccessful and drew the attention of the proper authorities. Had we been actual criminals and attempting fraud, we would have been busted by law enforcement. The NCUA did a great job of getting the word out that such an attack had occurred and the media and security folks did a great job in spreading the word to prevent further exposures to this threat vector. Everyone, and I do mean everyone, is to be congratulated here for their efforts!

The system worked. Had we been bad guys, we would have been busted. The world was protected, once more, thanks to the vigilance and attention of the NCUA and the security community.

Now, about the testing. MicroSolved, Inc. does, indeed, test social engineering attack vectors as a part of our standard assessments. The social engineering threat is a powerful and valid attack vector that often leads to compromise. Our process for testing these engagements is well scoped, well organized and intensely controlled. The threats we emulate are very real (in this case, we even included typos and such in the fake letter). The simulated malware we use is a custom application, developed in house by my team of engineers and does not propagate in any way. It is safe, effective, tested and has been in use with ongoing revision and testing for more than five years. The entire process for testing social engineering has been performed thousands of times for thousands of clients and will continue to be a part of our testing methodology. We truly believe that information security starts and ends with the people involved in protecting the data.

I hope this answers any questions you may have about the process or the alert. If not, drop me a line at and I will try and assist you, if I can. I would really like to thank the NCUA, SANS, my technical team and the customer CU for their help and attention on this project. Thanks also, to all of the security folks and CU folks who helped spread the word about this attack vector. Though the awareness campaign was unintended, it certainly has raised the bar for would be attackers if they hope to exploit this in the future. Thanks for all of your hard work and attention!

Oh, and lastly, no, it is not us sending the laptops to governors of the states. It might not even be us sending the next round of CDs, USB keys or whatever new fraud schemes emerge in the future. But, regardless of whether or not it is us doing a test for your organization, or real criminals attempting to exploit you, don’t fall for it! Report these events to the authorities and let’s make use of the process that we have clearly established!

Thanks for reading and make it a great day!

Update: Thanks to NetworkWorld for their help on getting the word out. Thanks to @alexhutton as well for this article.

Announcing A Special InfoSec Community Site: InfoSec Junkyard Dogs!

We are excited to announce a special, online community we’ve developed especially for you. This site will be open for a limited time and will provide a great place to connect with other security professionals both from here and around the world. We also have a “Gas Card Giveaway!” Sign up early and have a chance to win either a $50, $25, $15, or $10 Gas Card. We’ll be giving away one gas card per day, for the next four business days: Wednesday August 26, Thursday August 27, Friday August 28, and Monday August 31.

Enjoy the last “dog days” of the summer by joining our new community! Click here to view the details in a PDF. See you online!

Yay! A Winning Anti-Virus Check! Or Not…

So today on my RSS feeds, I saw that a new version of the Sub7 trojan has been released. This new version, called “legends” has some new features and such for exploitation and maintaining control over infected systems.

Being curious, I uploaded the installer to VirusTotal to see what kind of hit ratio I would get. To my surprise, ~96% of the AV software there detected Sub7!

There are two ways to look at this, I suppose. It sure seems like a victory when you get such a high hit rate, but on the other hand there are likely some elements of this extremely well known code that haven’t changed since it first emerged on the scene in the 90’s. So, I would hope that we could detect it with a high accuracy rate. In fact, I had really hoped we could detect it at 100%, but it seems that some AV vendors still miss it. Still 96% is far better than the ~15% detection rate I got on another test like this, just a little bit ago.

The second way to look at it is that we still have long known malware that is not detected by some AV products. Now, given, that is a small percentage, but after all of this time, they can not detect Sub7? That would be pretty horrible if you happen to be a customer of theirs and your data is at risk. Compound this with the data from the breach reports that show increases in custom malware being used in attacks and you can see the problem from a new perspective. If we can’t detect malware from the 90’s across the board, then how can AV hope to continue to be seen as the magic bullet defense against increasingly complex and dynamic attack code in the future? Of course, the answer is, it can not. It NEVER HAS BEEN THE MAGIC BULLET THAT MANY IT FOLKS AND MANAGEMENT FOLKS BELIEVE IT IS.

Where does that leave us? Somewhere between victory and defeat? Right where we have always been, but maybe, just maybe, with a little more argument and knowledge for those “magic bullet” folks!

PS – Here is my VirusTotal submission if you want to check it out.

Remote Access Challenges in Pandemic Planning

One of the tools that organizations are leaning on for pandemic responses is remote access to computing systems. Technologies such as VPNs, Citrix servers, terminal servers and other forms of remote access are widely appearing in the plans we are reviewing and are among the most discussed items in the planning sessions we have been holding with clients.

However, there are some issues that are emerging around many of these tools. To start, they can introduce a great deal of risk to the IT infrastructure and security posture if they are not deployed and managed properly. For example, blindly exposing terminal services, SSH and other remote access technologies to the Internet is a common path to compromise. Attackers are very good at finding these services and exploiting them, either with technical exploits or through credential discovery via social engineering, browser attacks and/or brute force. These exposures are often present in the major data breaches and serve as a danger point for organizations.

Blindly exposing remote access mechanisms such as these is usually a pretty bad approach. A better approach is to leverage a stronger access method such as VPN. VPN technologies are typically built around stronger security platforms and with greater security in place to protect the users and the organizations they serve. They will require a bit more “care and feeding” than blind port forwarding deployments, but they are a much safer solution for remote access to your environment.

VPN technologies also do not need to be expensive. Projects like OpenVPN and other open source approaches have reduced the costs to deploy VPN access to the lowest of levels. Basically, the cost of hardware and the human resources to install and support the system are the only costs involved. Many tools exist in this family and more are emerging every day.

Another significant issue to consider when looking at the remote access capability of your pandemic plan is capacity. More than likely, your solutions were implemented, as are most, with the idea that a somewhat limited subset of your entire employees would be using the access tools at any given time. That may not be the case in the event of a pandemic. The number of employees accessing the system may exceed your current designs and testing, so be sure you think through how you can expand that capacity, rotate shifts or use other techniques to plan for the impact from the surge in demand.

Lastly, be sure and test these mechanisms before you need them. Things in life often don’t work as planned the first time around, so practice for pandemics before one arrives. Have dedicated work from home days, plan for teams or lines of business to practice their plans and create lessons learned feedback loops to capture issues and work on minimizing them.

Preparation will likely pay off, both in the continued operation and bottom line of your business and in the reduction of panic should a pandemic every rear its ugly head. Thanks for reading, and let us know if we can assist you in planning or testing with pandemics in mind. Please, stay tuned to the blog for more information on the possible H1N1 pandemic, pandemic planning and other security issues that might emerge. At MSI, we are dedicated to helping you establish the means and mechanisms to keep your business, your business…

Official Press Release: MicroSolved Releases HoneyPoint Security Server Console 3.00

COLUMBUS, Ohio August 19, 2009 – MicroSolved, Inc. is pleased to announce their latest HoneyPoint Security Server Console 3.00 is available for organizations, offering faster performance and more detailed reporting.

HoneyPoint Security Server Console 3.00 provides cleaner performance and stability,superior memory handling, optimized database, and faster, more enhanced reporting. HoneyPoint Security Server Agent will also experience an upgrade and version 3.00 will be available in the Fall. Current users can upgrade via the FTP site or call support for assistance.

“The 3.00 release continues the tradition of evolution for the HoneyPoint family,” said Brent Huston, CEO and Security Visionary for MicroSolved. “It clearly reinforces the value and capability of applying bleeding-edge thinking to the information security problem.”

Huston developed HoneyPoint Security Server three years ago, motivated by a keen desire to break the attacker cycle. Huston concludes, “Attackers like to scan for security holes. HoneyPoint lies in wait and traps the attacker in the act!”

If youʼd like more information about this topic, or would like to schedule an interview Brent Huston, please email Mary Rose Maguire at

HoneyPoint Security Server Console 3.00 Released

This is an informal notice to the readers of the blog and the Twitter feed that we have made the 3.00 console release available on the FTP site. You can get the latest version using the credentials shipped with your original purchase.

Installation and upgrade is through the normal processes. Please let us know if you have any questions. A formal announcement and press release will be forthcoming tomorrow, but we wanted to give our readers a chance to grab the code before the onslaught begins. 🙂

Thanks to everyone who participated in the 3.00 testing and we are very happy to make this available. The next release will likely be the 3.00 version of the newly consolidated HoneyPoint Agent and Configuration Utility. More on that in the near future!

ABC News Reports Shortage of H1N1 Vaccine

ABC news is reporting that a shortage of the vaccine for H1N1 is looming. This is mostly due to the virus being slower to reproduce in the chicken egg medium used to grow the viral load for the injections.

Health care workers and children will receive the bulk of the available vaccine when it is available, likely beginning in October.

Since most of the work force are not children or health care workers, this leaves quite a large population that should be planned for absences from work. Many people will become ill from the virus or be required to miss work taking care of others who are ill from the virus if the current trends continue.

While not ill, your organization should provide these workers a mechanism for working remotely, if possible. This not only allows you to continue your business operations, but also allows those with exposures to the virus to “work from home” limiting their contact with the rest of your team and the public in general.

This is the basis for the pandemic planning that is required and that we have been discussing in previous blog postings.

All businesses are urged to consider pandemic planning a priority and to consider creating, testing and revising their current plans.

Pandemic Planning Coverage

Over the next few weeks, we will be presenting some blog coverage and a couple of public talks about pandemic planning. Given the current information on the H1N1 virus and the outlook from the CDC & WHO, we feel this to be prudent. I wanted to publish this post to draw your attention to the situation and to reinforce the idea that pandemic planning is the exact process to avoid PANIC.

Planning for situations is a responsible, mature act. Panic is a dangerous, and often disastrous response to a problem. Our goal, over the next few weeks is to get you thinking about pandemic planning. While the H1N1 threat may or may not immediately emerge as a significant issue, planning for such events is, in our opinion, a wise investment.

As we move forward in discussing pandemic plans, it will be in the flavor of disaster recovery and business continuity. Hopefully, you already have a basic plan, and this will serve as more of thought points for evaluation and consideration. If you do not yet have a plan, then please use this coverage as a basis for developing one.

Our framework will be around the primary 3 areas: Technology, Policy and Process and Awareness.

Here is a quick and dirty mind map of the topics we will be covering.


Keep your eyes on the blog for events around pandemic planning and related topics. As always, feel free to let us know your thoughts and comments, as well as any helpful tips you would like to share with others.

Updated Note: Thanks to WordPress for making the above graphic unusable, even when saved. You can download the png image at full (readable) size from here.